Gartner: Entrust Named a Leader in Identity Verification

Open Web Portal Support
Signhost logoSignhost logo
Log in

What is an Advanced Electronic Signature (AES)?

An Advanced Electronic Signature (AES) is a digital signature that offers advanced security features. It ensures the authenticity, integrity and non-repudiation of electronic data. According to the eIDAS regulation, an AES should be:

  • Uniquely linked to the signatory;
  • Able to identify the signatory;
  • Created using electronic signature creation data authorised for use only by the signatory; and
  • Linked to the signed data, ensuring that any future changes can be detected.

Key features

An AES incorporates these core features:

Authentication

An AES uses cryptographic algorithms to authenticate the signatory’s identity. It employs digital certificates and biometric verification to ensure that the signature can be traced back to the authorised entity.

Integrity

A fundamental aspect of AES is ensuring the integrity of signed data. It applies hashing algorithms to electronic data before signing, generating a unique digital fingerprint. Any subsequent changes will alter the fingerprint, indicating tampering.

Non-repudiation

AES ensures non-repudiation of electronic data. This means that the signer cannot refute their signature. It uses cryptographic keys and secure protocols, uniquely binding the signatory with the signed data.

Creation and verification process of an AES

Creation of an AES

An AES can be created using a Secure Signature Creation Device (SSCD). These devices generate a pair of cryptographic keys; public and private. The private key is stored within the SSCD, while the public key is made available for verification.

After the data to be signed is prepared, it is hashed to create a unique fingerprint. The data is then sent to the SSCD which uses the private key to apply a digital signature.

Verifying an AES

The recipient uses the signer’s public key to verify the digital signature and retrieve the unique fingerprint. This is compared with a newly calculated fingerprint of the received data. If they match, the signature is deemed valid. 

Why use an AES?

Here are the reasons to use an AES:

  • Its legal precedence makes it suitable for enforcing contracts, agreements and other legal documents.
  • It eliminates the need for physical paperwork and manual signatures, resulting in faster turnaround times, reduced administrative load and cost savings.
  • It provides enhanced security compared to traditional signatures, lowering the risks of forgery, tampering and unauthorised access.

Common uses of AES

  • Authenticating business transactions: To validate and authenticate commercial contracts, franchise agreements and other legal documents.
  • Securing transfer of funds: To authorise and verify wire transfers, payment orders and digital transactions.
  • Protecting electronic health data: Used by healthcare professionals to authenticate their electronic signatures, ensuring the integrity and confidentiality of medical records, prescriptions and patient consent forms.
  • Streamlining KYC processes: To electronically sign account opening forms and identification documents, enabling faster setup and optimising Know Your Customer (KYC) operations.

Comparison with other signatures

The eIDAS regulation mentions three levels of electronic signatures, Simple Electronic Signature (SES), AES and Qualified Electronic Signature (QES). Here is how AES compares to the other two:

SES

SES is the most basic form of electronic signature. It lacks advanced security features offered by AES, such as encryption, authentication and non-repudiation. Unlike AES, SES does not offer protection against forgery, tampering or unauthorised access. It is commonly used for informal or low-risk transactions.

QES

QES offers similar security features as AES, but it adheres to strict legal standards outlined in eIDAS. Unlike AES, it is created using a Qualified Signature Creation Device (QSCD). While AES offers a high level of security, QES is mandated for specific communications where strict regulatory compliance is necessary, particularly as it holds the same weight as a wet signature in the EU. 

*Disclaimer: This content does not constitute legal advice. The suitability, enforceability or admissibility of electronic documents will likely depend on many factors such as the country or state where you operate, the country or state where the electronic document will be distributed as well as the type of electronic document involved. Appropriate legal counsel should be consulted to analyze any potential legal implications and questions related to the use of electronic documents.