Numerous state regulations adopt the NCEES model language for the use of digital signatures. This language says, among other things, that the signature must be "capable of verification." It is not clear to me what this means, though I can make some guesses. Is there any authoritative answer as to what, exactly, must be verifiable when using a digital signature to sign an engineering document?
$\begingroup$
$\endgroup$
1
asked Aug 29, 2018 at 13:48
-
$\begingroup$ Questions about licensure are on-topic. I have re-opened the question and cleared out the earlier comments. $\endgroup$– user16Commented Aug 30, 2018 at 12:34
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
The question mentions numerous states, but I will use Washington State as a defined example.
Law
The state law interpreted guidance in Washington states this:
Digital Signature
A Digital Signature has the following properties:
A. It has a hardware or software cryptographic protection (such as a public/private key pair) that is unique to the licensee.
B. It can be independently verified by a third-party certification authority.
C. The Electronic Record to which it is attached is encrypted such that the recipient can verify that the document was uniquely signed by the licensee.
D. The Electronic Record to which it is attached is encrypted such that the recipient can verify if the document has been altered since the licensee signed it.
Implementation
I haven't seen very many variations in usage. All of the digital signature that I have seen are on Adobe PDFs. Their help goes through the details of how to actually use the signatures, but it also mentions how each part meets the law as stated above.
Certificate-based Signatures
On this page, the following is stated:
The digital ID contains a private key and a certificate with a public key and more. The private key is used to create the certificate-based signature. The certificate is a credential that is automatically applied to the signed document. The signature is verified when recipients open the document.
When you apply a certificate-based signature, Acrobat uses a hashing algorithm to generate a message digest, which it encrypts using your private key. Acrobat embeds the encrypted message digest in the PDF, certificate details, signature image, and a version of the document when it was signed.
This statement basically meets all of the items as described in the law.
Adobe has a separate page that talks about how the verification works, but that is only more background information stating that it does was is described above.
Answer
All of that above is a lot of text that basically says that the entire process works together, i.e. signing and verification are parts of the same general process. There is no one part that is verifiable; either the entire document (signature and document) are verified, or they aren't. If you think about it, there is no use to have one or the other.
As I mentioned in the beginning, I'm sure that there are other available methods/programs, but I have only ever seen the Adobe version in practice.
-
$\begingroup$ Washington does seem to provide a little more guidance than some states. But I think what you're saying is that what must be verifiable is that the signature is MINE and not forged. Otherwise there's no need for a certificate authority to get involved. Am I understanding your answer correctly? $\endgroup$ Commented Aug 29, 2018 at 17:57
-
$\begingroup$ I would say that there is room for some disagreement, but the strict reading of "Third Party" would mean that it has to include a certificate authority (and the yearly fee that goes along with that). On the more lenient side, the fact that YOU have the signing key in your possession would be the equivalent of having control of the original wet signed plans. $\endgroup$– hazzey ♦Commented Aug 31, 2018 at 16:56