...
| Excerpt |
|---|
Some distinctive mark must be affixed to the original document as evidence of the electronic signature, binding the document to the signing party's identity, indicating their approval or adoption, and providing evidence of the document's integrity. |
Introduction
A traditional holographic (hand-written) signature affixes a distinctive mark to the original document (the signature) that may be used as evidence of the identity of the signing party, their approval, authorization, or adoption of the document, and that the document has not been altered subsequent to the signature. An electronic signature calls for a similar outcome.
...
| Panel | ||
|---|---|---|
| ||
(from policy directive 32-110 |
...
) |
Introduction
A traditional holographic (hand-written) signature affixes a distinctive mark to the original document (the signature) that may be used as evidence of the identity of the signing party, their approval, authorization, or adoption of the document, and that the document has not been altered subsequent to the signature. An electronic signature calls for a similar outcome.
| Excerpt |
|---|
Some distinctive mark must be affixed to the original document as evidence of the electronic signature, binding the document to the signing party's identity, indicating their approval or adoption, and providing evidence of the document's integrity. |
Binding Document to Identity
Some distinctive mark must be affixed to the original document as evidence of the electronic signature. This outcome has been articulated in the NMFS policy directive 32-110 as "...tie the electronic transaction to the individual or entity in a legally-binding way." In e-signature systems, the distinctive mark is going to be one or more data elements that have been associated with the individual or entity. A simplistic (but inadvisable) example would be to require the signing party to enter their social security number as part of the signing ceremony; the social security number could be considered a distinctive mark and stored in a database table with the document, the date and time of the e-signature, and other contextual data.
...
In practice a social security number should not be used directly for this purpose, but some other identifier could serve the same function. The requirements for the identifier are that it is distinctive and unique to the individual, and can be associated as necessary with other data pertaining to that individual.
...
Alternative | Document Binding, Integrity, and Audit Trails Mechanisms | Confidence | Characteristics |
|---|---|---|---|
Typical online system practices | write the individual's identifier, the signed document, and contextual information into the database as a relation, with typical constraints, access controls, and security procedures | low | fast implementation, |
Secure online system practices | rigorous constraints, access controls, and security procedures, including audit trails in the database layer (in addition to any controls in the application layer), trusted time sources, logging of security events in the database layer and/or the system software layer, etc. | moderate | moderately expensive to implement and maintain, |
Package with a Digital Signature | pre-process the document using a mathematical function that would imprint the identifier and contextual data on the document, and then store the resulting imprinted document along with the identifier and contextual data, which should include a trusted timestamp. | high | expensive to implement and maintain, security characteristics are complex and unfamiliar |
USPS Electronic Postmark | submit the document, identifier and contextual data to the US Postal Service Electronic Postmark system (EPM) and store the resulting confirmation code with the signed document | highest | inexpensive to implement but expensive to maintain, security characteristics are based on trust in the institution of the USPS |