Digital signature

A digital signature is a cryptographic mechanism that uses a pair of keys, one private and one public, to prove who signed a piece of data and that the data has not been altered since. People often use "digital signature" and "electronic signature" interchangeably, but in technical and legal writing the digital signature is a narrower, math-based subset of the broader category.

Here is how it works. The signer's software computes a hash of the document, a short fingerprint produced by a function such as SHA-256, and then transforms that hash with the signer's private key. Anyone holding the matching public key can reverse the transformation and compare the result with a fresh hash of the document. If they match, the document is unchanged and the signature was made with that private key.

The public key alone does not say whose key it is. That link comes from PKI, the system of certificate authorities that issue digital certificates binding a public key to a named person or organization. When a PDF reader shows a green tick and a signer's name, it has checked the signature against a certificate chain it trusts.

Picture a procurement team at a mid-sized manufacturer that receives signed supplier contracts from a government agency. The agency's PDFs carry certificate-based digital signatures, so the team's reader can confirm the file came from the agency's signing certificate and that nobody edited the pricing table in transit.

The biggest misconception is that a digital signature is automatically more legally valid than other electronic signatures. Under the ESIGN Act and UETA, US law is technology-neutral, so a typed name with good evidence can be just as enforceable. In the EU, digital signatures are the usual technical basis for advanced and qualified electronic signatures under eIDAS, but it is the qualified level, not the cryptography itself, that carries special legal presumptions. Another mix-up: digital signatures are not encryption. The document stays readable; the signature only proves origin and integrity.

Our take: digital signatures are excellent technology, and certificate-based signing makes sense in regulated or cross-border settings. For most contracts between small businesses and their customers, though, the practical question is evidence, and a clear audit trail plus a verifiable document hash covers most of what people actually need to prove.

At eSignSimple we do not issue certificate-based digital signatures today. We record a SHA-256 hash of each completed file and publish a /verify page where anyone can check that a copy matches the original, alongside an audit trail and certificate of completion. Certificate-backed signing sits on our roadmap rather than in the current product.