An electronic signature is a digital certificate containing a set of metadata that can be used to verify identity. In essence, it is not a physical object, but a set of software code with a specialized algorithm for creating and verifying the authenticity of a key that cannot be faked. What does an electronic signature look like and how can it be found on the same document?
Read in the article
What does the digital signature look like on a document?
An electronic signature is a unique sequence of characters. It acts as a mandatory requisite placed on official electronic documents. Reliable cryptographic methods and mathematical calculations are used to generate the signature, and the software is FSB certified.
There are 3 types of digital signature:
- simple;
- unskilled;
- qualified.
A simple electronic signature (SES) is a code or password created by the system and sent to the user’s phone or email address. Typically used on websites to confirm an action. An unqualified signature (NES) differs in that it requires confirmation of the client's identity and is formed using a cryptographic transformation.
The most reliable is a qualified digital signature (QDS). It is confirmed by a verification certificate, has a private and public key, and gives the document full legal force.
A key certificate is a file with a .crt extension that contains information about the owner, the certificate's thumbprint, and the validity period of the signature.
An electronic signature on a document looks like:
- a sequence of letters or numbers that corresponds to the key specified in the certificate;
- a graphic picture or stamp indicating the signature of the certificate owner.
The most reliable is the invisible ES, which is not visually detected. It is used when creating MS Word, Excel documents, and is generated automatically. You can determine its presence by the mark that appears in the “status” column.
An example of what an enhanced qualified electronic digital signature looks like is an extract from the Unified State Register of Legal Entities certified by the Federal Tax Service. The signature here is a stamp indicating the certificate number, owner, and validity period of the electronic signature.
Sample:
What does a document signed with digital signature look like:
Other digital signature options
What does the issued digital signature look like? In the form of a USB token.
However, theoretically, software for creating digital signatures can also record on:
- smart cards;
- U-Sim cards;
- a regular USB drive (only non-qualified digital signatures).
But the most popular now are USB-rootkens , since to use them you do not need to buy additional equipment (such as a smart card reader), and they are also protected from mechanical damage, copying, and so on. At the same time, the token itself costs only about 1000 - 2000 rubles, and even if it is lost, the drive can be restored at any certification center.
But almost no organization offers those same smart cards or U-Sim anymore. And they are more difficult to work with, they require the installation of additional software, and some operating systems do not support working with them at all (for example, their support was never organized in BSD systems).
What does the stamp on ED imaging include?
According to GOST R-7.0.97-2016 dated July 1, 2018, the electronic signature form must contain a new form with the “electronic signature mark” attribute. It is mandatory for any ED when it is visualized, scanned or printed in the place where a signature is usually affixed on paper by hand.
The mark is placed on a document signed with an electronic signature, which is:
- printout of the electronic contract;
- printout of the protocol of consideration of applications and their assessment for participation in bidding on the ETP;
- responses to requests from regulatory authorities.
The electronic signature stamp must include the following details:
- signature key certificate number;
- Full name of the owner of the digital signature;
- expiration date of the certificate;
- a phrase stating that the document is signed by an electronic signature.
Additionally, the stamp may contain the following emblem:
According to the requirements of the standard, the electronic signature mark must be readable, and its elements must not intersect or overlap each other.
How to mark
Typically, two options are used to mark an electronic signature:
- making a stamp and then inserting it into copies;
- setting up a signature in MS Office.
To set up a digital signature via MS Office, in an open document, go to the “Tab” submenu and select “Signature Line”:
Next, select “signing”:
If a stamp is made, then it is inserted into the copy in the usual way by inserting a picture or drawing and placed in the desired place.
Types of ES
The regulatory framework of the Russian Federation regulating the use of digital signatures distinguishes the following types:
- simple;
- reinforced (qualified and unqualified).
The main difference between the types of signatures is the degree of security. A simple signature is intended for documents that do not require a seal, and a reinforced signature is used for documents that, in accordance with the law, must be certified by a seal.
An enhanced signature can be qualified or unqualified, which differ from each other by the presence of a certificate issued by a center accredited by the Ministry of Telecom and Mass Communications of Russia, and its absence.
What is a time stamp
Clients of the CryptoPro TSP system can additionally receive time stamps. The signed data is the hash function value and the time the stamp was affixed. The requisite is associated with the ED for which it was issued and ensures its integrity.
To issue a stamp and implement a service based on CryptoPro, you need to create a separate TSP server and add CryptoPro TSP Client to the workstation software.
Advantage of time stamp:
- recording the time of ED creation;
- recording the time of digital signature formation;
- recording the time of the ED processing operation;
- long-term storage of digital signature (even after the expiration of the user’s digital signature certificate).
When opening a document and viewing information about the digital signature, the time stamp will look like this:
Working with the TSP protocol is simple, and is based on interaction with the server using the “request-response” type. The user creates a request, sending it to the server, and receives a response that contains the generated time stamp. If an error occurs, the response will contain an error code instead of a stamp.
Electronic signature on physical media
Despite the fact that an electronic signature is the result of cryptographic transformations, and it is impossible to know what it looks like, we can see its physical medium.
There are several types of physical electronic signature media:
Flash drive
is a device in the form of a USB flash drive with flash memory for storing data.
Token
– a device in the form of a USB flash drive with a password-protected memory card on which information for creating a signature is stored. The token provides two-phase user authentication: to work, you need to insert the token into the USB connector of the computer and enter the password.
Smart card
– a plastic card, similar in appearance and size to a regular bank card, allowing for cryptographic operations.
Sim card
with chip – mobile operator card with java application
The most secure and convenient to use at the moment is the medium in the form of a token. The security of tokens is constantly improving - in particular, in new versions, document encryption operations are performed not only on the computer, but also on the device itself. This makes the electronic signature more secure from viruses and hacker attacks.
Is compliance with GOST mandatory or not?
There is a GOST for electronic signature. In the unified register it is listed under number 7.0.97-2016. The standard contains rules for the generation of documents both in paper and electronic form, and addresses issues such as:
- location on the media of the necessary details;
- requirements for the creation and execution of electronic documentation, including the use of IT.
GOST rules are regulated by Article 26 of Federal Law 162 dated June 29, 2015. Article 6 of Federal Law 162 provides for the mandatory use of standardization documents for defense products, state. orders for goods and services used for data protection, as well as for providing information related to nuclear energy, etc.
Based on regulatory documents, GOST requirements on information standards are not mandatory and their non-compliance does not violate current legislation.
Certificate catalog
Electronic signature for bidding
- Sberbank-AST
- EETP
- OSET Zakaz RF
- MICEX "Government Procurement"
- RTS "Tender"
from 2,500 RUR
more details →
Order
Qualified electronic signature
- Procurement and bidding under 223-FZ
- Public services portal
- LLC Zakupki.gov.ru
- EFRSB and EFRSDFUL
- Electronic trading
from 3,000 rub.
more details →
Order
Qualified electronic signature for EGAIS
- 5 government procurement sites
- Procurement and bidding under 223-FZ
- Electronic trading
- Public services portal
- EFRSB and EFRSDFUL
from 1,500 RUR
more details →
Order
Electronic signature 3.0
- 5 government procurement sites
- Procurement and bidding under 223-FZ
- Electronic trading
- Public services portal
- EFRSB and EFRSDFUL
from 2,500 RUR
more details →
Order
all types of certificates"
Signing Key Certificate
is a document in electronic form or on paper that contains an electronic signature key to confirm the authenticity of the signature and identify the user of the signature key certificate. The creation and issuance of verification key certificates, as well as the provision of other services related to the use of digital signatures, belong to the activities of accredited certification centers.
Loss of legal significance of electronic signature
An official document has legal force and legal significance. The first term means that the document has legal consequences. Significance is a proof of business activity.
The Federal Law on Electronic Signatures specifies that in EDI a document is certified using special technologies and electronic signatures. To have legal force and serve as proof of action, the ED must have the following details:
- name;
- number;
- indicating the full name of the author of the signature, the name of the company and the person authorized to sign;
- date of compilation;
- signature.
The law also prescribes three types of electronic signature, the characteristics of each of them, legal force, method of receipt and validity period. According to the bill, only documents signed with a qualified electronic signature have legal force. The NEP gives legal force to e-documents if there is a separate agreement between the participants of the e-document flow.
The digital signature loses its legal force in the following cases:
- the signature was made by a person who does not have the right to act on his own behalf or on behalf of the organization;
- the ED does not contain all required details;
- the format and method of transmitting ED is not followed;
- the certificate will expire at the time of signing or verification of the ED;
- The electronic signature was used in violation of the information specified in the certificate.
The agreement between the EDF participants prescribes the requirements for recognizing the equivalence of documents with electronic signature and on paper, and their violation also leads to the loss of the legal significance of the document. Typically these include:
- mandatory sending of ED from a secure mailbox, access to which only the owner of the signature has;
- the public key must be enclosed in the letter;
- the mail service should have limited access.
The same conditions are used for corporate digital signature. Working with public postal services reduces the legal force of a simple signature and makes it impossible to use it to certify documentation.
Is it possible to copy an electronic signature?
Theoretically, it is possible from a USB token, but their hardware limits the ability to copy content. Therefore, it will not be possible to copy and subsequently forge a key, or rather, this requires expensive equipment that cannot be purchased without special permission. In general, the state made sure that the digital signature key was completely protected, and there was no possibility of forging an electronic signature at all.
To work with digital signatures, you also need to use special CryptoPro software. It is with its help that signed files are decrypted (of course, if there is a decryption key). The owner of the signature can also restrict access to the contents of the created object for third parties by enabling access by password or key. But this function currently works exclusively in Microsoft Office, partially in LibreOffice (a popular text editor in Linux distributions).
Use of electronic signature in judicial practice
The use of an electronic signature sometimes complicates legal proceedings. The chief accountant can certify the statements instead of the manager, and the lawyer can certify the application for the court instead of the plaintiff. Similar violations occur when using client-bank software, when payment orders are not sent by the owner of the electronic signature.
When considering claims for unlawful debiting of funds from an organization’s current account, the court recognizes the correctness of the bank’s action, since the electronic signature is correct, and considers the transfer of signature rights to a third party as a violation of contractual relations and customer service rules.
A similar practice occurs when participating in electronic government auctions. If an organization does not sign a won contract in a timely manner, it is recognized as a party that has evaded concluding a contract and is entered into the register of unscrupulous suppliers. In judicial practice, there are also frequent cases when an organization is entered into the register because of a contract signed by a person who does not have the right to certify such documents.
In civil legal relations, disputes between counterparties arise about the legality of documents signed by electronic signatures of unauthorized persons. When making a decision, the court proceeds from checking the validity of the electronic signature certificate.
The legislation of the Russian Federation does not directly prohibit the transfer of electronic signatures to third parties with the consent of the owner, and in the event of controversial situations, the court recognizes the owner of the signature as the person who signed the document. All responsibility for the use of the digital signature lies with the owner of the certificate, and if the key is compromised, he is obliged to contact the CA with an application to suspend the signature. In controversial cases, such an appeal can serve as evidence of damage caused not by the owner of the signature, but by a third party.
Signing any files
To sign any file on your computer:
1. On the ribbon, on the Home
In the
“Prepare package of documents”
(or button menu), click the button.
2. In the window that opens, select the file that you want to sign:
3. In the “Select Certificate”
select the certificate from the list that you need to sign the document with and press :
With active switches:
— only valid electronic signature certificates are shown.
— only certificates issued by our Certification Authority are displayed.
Using the Sort
You can sort the list in descending or ascending order by end date, publisher, and name.
The program will sign the documents and display a message indicating that the signing was successful.
*.sig will be generated in the same folder where the signed file is located.
.
Additional Information
Can the sender's address of an incoming email be considered a simple electronic signature of the sender?
Answer: Yes, if the participants in electronic interaction have entered into an appropriate agreement (on recognizing the receipt of an electronic message from a specific email address by signing a PEP document), and also subject to one of the conditions presented in Article 9 of 63-FZ, which can be found in the material above.
You can ask other questions on the topic of PEP in the specialized section of the Unified Electronic Signature Portal “Question to an Expert”.
Signing any files
To sign any file on your computer:
- On the ribbon tab "Home"
press the button or the
F4
. - In the window that opens, select the desired file:
- Set the signature parameters and also select the encoding:
- In the “Certificate Selection”
, select the certificate from the list with which you want to sign the document and click:
When creating an attached signature, a new file is created in which the document to be signed and the signature to it are placed. To generate such a signature, uncheck the box “Generate signature in a separate file (detached)”
.
A detached signature is generated in a file separate from the document being signed. To generate such a signature, check the box “Generate signature in a separate file (detached)”
.
To select encoding
place the marker at the desired point.
Various structures have their own rules for accepting electronic documents. For example, Rosreestr accepts files with a detached signature in DER encoding.
These are the default settings.
To change the default settings, in the Settings
in the
“Signature”
, select the encoding as well as the signature type.
With active switches:
— only valid electronic signature certificates are shown.
— only certificates issued by our Certification Authority are displayed.
Using the Sort
You can sort the list in descending or ascending order by end date, publisher, and name.
The program will sign the documents and display a success message:
Which documents require a digital signature?
Most of the document flow has become paperless, and the use of digital signatures will no longer surprise anyone. The sphere of government procurement is no exception. Participants endorse submitted applications with an electronic signature, and customers are guaranteed to understand that potential suppliers are real companies. All contracts concluded as a result of bidding become valid only after being digitally signed. When else do you need an electronic signature:
- To submit reports to regulatory authorities (Tax Service, Rosstat, Pension Fund and Social Insurance Fund). Sending reports and certificates in electronic format makes the process easier and reduces the number of errors. Most services have built-in checks.
- When using EDF (electronic document management system). This is one of the most common uses. From a legal point of view, a letter endorsed in this way is equivalent to a paper version on which a stamp and a visa are affixed. Thanks to EDI, paperless document flow becomes a reality both within the organization and with external contractors.
- On the portal "State Services". Any citizen of the Russian Federation can obtain a cryptosignature for themselves and put marks on applications submitted through the State Services website, take part in public initiatives, etc.
- When applying to the arbitration court. Agreements with counterparties, official correspondence, and invoices signed electronically can be used as evidence. According to the Arbitration Procedure Code of the Russian Federation, such documents are equivalent to paper counterparts with a stamp.
Program "Signature Pro"
For convenient interaction with the Certification Authority of LLC “Program Center”, management of digital certificates and private keys of electronic signatures, as well as for signing various files with an electronic signature, the “Signature Pro” program was developed.
The “Signature Pro” program allows you to electronically sign files of any format, including XML files, and check the correctness of the created electronic signature.
