Use digital signatures

Digital Signatures are a type of Electronic Signature that uses a certificate-based Digital ID, obtained either from a cloud-based trust service provider or from the signer's local system.

A digital signature, like a conventional handwritten signature, identifies the person signing a document. Unlike a handwritten signature, a certificate-based signature is difficult to forge because it contains encrypted information that is unique to the signer. It can be easily verified and informs recipients whether the document was modified after the signer initially signed the document.

Adobe Acrobat Sign supports digital signatures by simply placing the Digital Signature field on a form (either via Text Tags, drag and drop in the Acrobat Sign Authoring environment or authoring in Adobe Acrobat with Acroforms).

Time Stamps

Time stamps are a critical component of both the US and EU signature compliance standards when applying digital signatures. 

The time stamp acts as a locking mechanism for both the signer’s identity and the document itself.  Identity can be established in a number of ways (certificate, logon, id card …) but the time stamp has to be provided by a trusted and authorized time stamping authority (TSA). 

The time stamp guarantees the Long-Term Validity (LTV) of the signed agreement by locking the signature as well as the document.  Essentially providing a lock for the lock.  This is critical for digital signature compliance because personal signing certificates can expire, while the time stamp LTV can be renewed over time without changing the validity of the signature.  The LTV time stamp assures the certificate was valid when applied and extends the validity of the signed agreement beyond the time scope of the signer’s actual certificate.

Qualified Timestamp for e-IDAS compliance in the European Union

All accounts on the Acrobat Sign EU1 instance in Europe have e-IDAS compliant Qualified Timestamps being applied by default. (Know what instance you are on)

How it's used

For Senders

From the Senders perspective, all that is required is for a Digital Signature field to be placed on the document that is being sent.

For Document/Template Authors

Each recipient can have, at most, ten digital signature fields assigned to them within an agreement. Any additional signature fields that are needed can be of the standard e-signature field type.

Keep in mind that just because one signer is using a digital signature, that does not mean that any other signers are required to. It's perfectly allowable to have only your internal signers apply digital signatures while external signers use the e-signature field type (or vice versa).

When multiple signatures are applied for one recipient, each field should have a unique name. e.g., {{digsig1_:signer1: digitalsignature}}, {{digsig2_:signer1: digitalsignature}}, and so on.

If a digital signature text tag name is duplicated, Acrobat Sign automatically renames the fields by adding a "-n" appendix, where 'n' is a number starting from 1 and is incremented for each duplicated field name found. e.g., {{digsig1_es_:signer1:digitalsignature}} will become {{digsig1-1_es_:signer1:digitalsignature}} and {{digsig1-2_es_:signer1:digitalsignature}} and so on.

Using Drag and Drop Authoring

Template creators will find the Digital Signature field in the Signature Fields section of the Authoring environment.

Below you can see the e-signature field on the left, and the digital signature field on the right.

Text Tag Syntax

The syntax for a digital signature field uses the argument :digitalsignature

For example: {{digsig1_es_:signer1:digitalsignature}}

Building forms in Acrobat

Like all other field types, you can replicate the functionality of a Text Tag when building your documents in Acrobat by renaming the field to contain the full text tag with all arguments (but not the brace pairs on either end).

The Signer's experience

Because digital signatures are certificate-based, signers need to obtain a Digital ID before they can apply their signature. This Digital ID can be obtained from one of several cloud signature providers, or by applying the signature using Adobe Acrobat or Acrobat Reader, using a local Digital ID.

The Acrobat Sign solution walks the signer through the process:

• Open the agreement, and fill in any required fields
• Choose from existing Digital IDs, or create a new one
  
• Apply the signature

Once the signature is applied, the signature cycle continues as normal.

Open the agreement and fill in the fields...

Signers are notified via email, and instructed to open the agreement by clicking the Review and sign button

Once the document is open, the signer can read the document and fill in any fields that are needed. All required fields need to be completed before the signer can advance the signature process.

Mousing over the digital signature field prompts a text balloon with additional instructions.

Clicking the field opens an overlay asking the signer to select one of two paths:

• Cloud Signature (the instructions below follow this path)
• Download and Sign With Acrobat (Click here to jump to the download instructions)

Select the appropriate option and click Next

A new overlay is presented, asking the signer to select an identity provider from a drop-down.

• Only providers listed in the drop-down can be used 
• Signers that do not have a permissible Digital ID can click the Click to get a new Digital ID link, and be routed to obtain a new Digital ID from one of several cloud signature providers. 
• Once they have established a new Digital ID, they can return to the signature process.

The identity provider challenges the signer to authenticate to their service

Once successfully authenticated, the signer is presented with a list of valid Digital IDs to choose from.

• Select the Digital ID
• Click Next

A preview of the signature is presented.

• Click Edit Signature to:
  • Manually sign via mouse or touch pad
  • Upload a signature image
• Click OK when ready to proceed

The signer is returned to the agreement and prompted to Click to Sign

The identity provider then may require an additional, second-factor authentication.

eg: The below provider requires a static PIN, established when setting up the Digital ID, and a one-time password.

• Enter any required values, and click OK

When the second-factor authentication is successfully entered, the document is signed, and a success message is displayed.

.

History and Audit Report

The History tab, and the related Audit Report, are slightly different than a standard e-signature report in that they have an additional event: Document digitally signed

In the example below, you can see that the first signer has one "e-signed" event, and that is all.

The second signer has both an e-signed event as well as a digitally signed event.

The reason for this is the digital signature process takes place in two parts.  The part you do in the web browser (filling in the fields), and the part that you do on your local desktop (applying the digital signature certificate).

When the signer completes the field portion and clicks the Submit and Proceed to Sign button, the input content is uploaded, and pressed into the PDF. This is what the e-signed event indicates.

When the digital signature is applied, the digitally signed event is posted.

Keeping in alignment with the History information, you can see that the audit report also reflects the two stages of the signature process.

How to configure

The Digital Signature workflow can be enabled at the Account level by the Acrobat Sign Account Admin.

• Group level settings are permitted and will override the Account level values.

To access the Account level settings, navigate to: Account > Account Settings > Digital Signatures

There are several options that can be configured to manage the signature experience:

Show Signing Reason

Some compliance requirements demand that a reason for an applied digital signature be noted by the signer. eg: Title 21 CFR Part 11 and SAFE-BioPharma compliance.

If digital signatures are being used to fulfill a compliance demand, consult with your legal team to determine if you should also require a signature reason within the signature process.

To access the controls, click the Bio-Pharma Settings link

If you need advanced signature controls, refer to the BioPharma page >

Restricted Cloud Signature Providers

There are some providers that restrict access to their service only to pre-authorized customers. This means that the service will not be accessible until the provider has authorized the account to use it.

During the activation process, these providers require the subscribing customer to provide their Account or Group ID to configure the service. Once authorized by the provider, your users will be able to use the restricted service.

Digital Signature Format options

PKCS#7 is the default format governing the digital signature for most (non-EU) Acrobat Sign accounts.

Accounts on the European (EU1) shard use PAdES format (ETSI EN 319142) by default to meet eIDAS compliance.

Any account level admin can request to have this setting changed from one format to the other by sending a request to the Acrobat Sign Support team.

This feature can be enabled and configured at the group or account level.

RSA-PSS

RSA-PSS is a signature scheme that is based on the RSA cryptosystem and provides increased security assurance relative to the older RSA-PKCS#1 v.1.5 scheme. 

The Acrobat Sign implementation of RSA-PSS does not require any configuration on the part of the Account Admin.

• When “Cloud Signature” is chosen, and the signer’s Digital ID supports both RSA-PSS and RSA-PKCS#1, the RSA-PSS signature scheme is used by default.
• When “Sign with Acrobat” is chosen, the use of RSS-PSS or RSA-PKCS#1 depends on the signer's settings in their Acrobat application
• Acrobat Sign fully supports CRL and OCSP responses that are signed with the RSA-PSS scheme.
• The use of the RSA-PSS scheme is required to comply with Germany-specific requirements for Qualified Electronic Signatures.

Things to Know

The digital signature workflow forces the agreement into a unique process. Because of the special handling required to get the signature affixed, there are several limitations to be aware of.

• Each signer can have only one digital signature field assigned to them when downloading the document and signing with Acrobat. Cloud-based signatures can support up to 10 digital signature fields per recipient. (Aadhaar and Singpass are not supported.)
  
• Web forms don't support digital signatures.
• Send in Bulk does not support Download and Sign With Acrobat signatures. Cloud-based digital signatures work as expected.
• Digital signatures are not supported in Microsoft Office Desktop apps, as they're designed to work inside a browser environment. Alternatively, you can use the Office Web apps from your browser.
• Digital Signatures disable Limited Document Visibility. All recipients will see all pages.
• Signers on Mobile devices can only apply a cloud-based digital signature.
• Cloud-based Digital ID using OAuth authorization mode are not supported in Fill & Sign feature.
• Fill & Sign feature does not support signing with Aadhaar service provider.
• Users sharing their content or accounts with advanced sharing enabled cannot use digital signatures.
• eVaulting cannot be used in conjunction with digital signatures.
• File attachments can only be applied by the first signer. Subsequent signers that attach new files invalidate all previous digital signatures.
• Transaction Number fields will convert a digital signature into an electronic signature.
• The optional setting to Keep documents separated (when more than one is used to create the agreement) isn't currently supported. The document can only be returned as a single, complete file.