Electronic signature as (broadest) category
According to the EU eIDAS regulation, an electronic signature means
- data in electronic form which
- is attached to or logically associated with other data in electronic form, and which
- is used by the signatory to sign.
Such a definition covers everything from a scanned handwritten signature on a paper, to a digitally created graphic entry of a name (scribble or perhaps just a digitally typed name, e.g. in Word doc or in an email), a biometric signature, or a file created using a sophisticated method based on asymmetric cryptography.
Advanced vs Qualified e-signature, and others
Essentially, there are two types of e-signatures that are recognised under the current laws.
Advanced electronic signature (AES)
AES is an e-signature which
- is uniquely linked to the signatory,
- is capable of identifying the signatory,
- is created using electronic signature creation data that the signatory can, with a high level of confidence, use under his sole control, and
- is linked to the data signed therewith in such a way that any subsequent change in the data is detectable (i.e. it ensures immutability).
As of today, only e-signatures based on asymmetric cryptography fulfil all the above requirements.
Qualified electronic signature (QES)
QES means AES that
- is created by a qualified electronic signature creation device, and
- which is based on a qualified certificate for electronic signatures.
So if we put all the above definitions together, we get that:
- QES is a subcategory of AES; essentially, the only difference is that QES is created using a qualified electronic signature creation device (QES-CD) – token or a chip card.
- AES is itself a subcategory of e-signatures.
Simple e-signature
Further on, for anything that falls into the category of e-signatures, but not so in the category of AES, a term "simple e-signature" is being used.
Those are, for example, already mentioned biometric signatures, digital scribbles made in Word docs, or scanned "wet ink" signatures.
Mr. "Recognised e-signature", it's nice to meet you!
To make things not too simple, the Czech laws further work with the term "recognised electronic signature" (in Czech "uznávaný elektronický podpis").
This is a hybrid that includes all AESs based on qualified certificates, which is, apart from QES, also any AES based on a qualified certificate, though not created by QES-CD.
Is this clear? More on the technical aspect of guaranteed e-signatures next time.
