Some EU signatures: Paid for yesterday, worthless today - be careful when choosing

I occasionally take a European tour of the world of trust services and examine how electronic signatures are marketed.

Yesterday, I received a mind-blowing email from an EU trust service: the signature I bought with cash and placed on a document might be as worthless as an expired yogurt tomorrow, given that the related signature certificate is only a maximum of three years old. A time stamp could provide some assistance, but it wasn't part of my signature package

I imagined what it would be like in the analog world if I had to pull out all the documents from the last ten years and sign them again by hand. That would be comparable to the situation mentioned above. How can you offer qualified electronic signatures without a time stamp these days? It's like selling a car with a warranty of just one kilometer.

First, the time stamp - similar to the analog date on the signature (often even "place") - proves that the signature was not applied retrospectively or, more precisely, backdated. Imagine a letter of termination that is backdated by 3 months. Even in the analog world, case law has relied on a kind of "qualified time stamp", often stating: "The postmark on the letter is decisive" or something similar. With the computer clock in the signature, visible in Adobe, e.g., with the note "Signing time is from the clock on the signer's computer", every signature can be electronically backdated and postdated as required:

Certified Adobe-1

Yet, I stumble across such contracts all the time, and eIDAS has already defined the qualified electronic time stamp.

An eIDAS-qualified electronic time stamp, which has already been applied with the signature, confirms that the signature was valid at a certain point in time. In the EU, the so-called PAdES format for PDF signatures is even prescribed by law in the context of public authorities: A particular area in the PDF document, the so-called "Document Security Store" (DSS), is filled with verification information in addition to the signature, which is required to assess the validity of a signature.

For example, the entire chain of certificates (including the root certificate belonging to the trust service itself) is placed up to the signatory's signature certificate. This chain is crucial for verification, even if, for example, the Internet is not available. In addition to the aforementioned time stamp, information about the revocation status of all certificates used in the certificate chain is stored in the DSS. Typically, a service of the trust service is queried for this, the so-called "Online Certificate Status Protocol" (OCSP) service, which can confirm the validity of a certificate or even report that it has been compromised. All this data is stored in the DSS and now provides precise information on whether a signature was valid when signing. This facilitates verification over long periods, and it no longer matters whether the certificate has expired. This is referred to as the long-term validation option (also known as LTV in Adobe PDF Reader). Even years later, the information stored in the DSS can still be retrieved, even if the original certificate services are no longer available. This is particularly important for legal documents and contracts.

Swisscom Trust Services always issues signatures with qualified timestamps and long-term validation options.

So, are you safe until the end of time? Unfortunately, this is not the case because there is still a risk that the signature algorithm will be "cracked," which means that one day signatures could be created that never existed, for example, by replacing the underlying document, for instance, with the help of quantum computers, which are currently under development. Nobody can predict today whether this will happen in 3, 5, or 10 years. Only one thing can help the "Preservation Service." The easiest way to achieve this is to regularly, for example once a year, oversign all electronically signed documents with a time stamp and the latest cryptology. There are also more efficient methods for a large number of documents in which all documents are organized in a tree structure, and only the "root" is re-signed. These so-called "Merkle Trees" are particularly useful when thousands of signed documents have to be legally valid for years.

Trust services always adapt their cryptological algorithms to the latest findings, including the timestamp, which will soon be fixed by a "quantum computer."

Customer success stories

Customer success stories

Some EU signatures: Paid for yesterday, worthless today - be careful when choosing

Swisscom Trust Services always issues signatures with qualified timestamps and long-term validation options.

Latest Blog Articles

Autenti and Swisscom Trust Services...

Swisscom Trust Services Announces...

Qualified e-Signatures for Tax...

Swisscom Trust Services launches in...