Signature Validation

Signature validation is the technical check that a signed document can be relied on. Article 3(41) of the eIDAS Regulation defines validation as the process of verifying and confirming that data in electronic form are valid in accordance with the regulation.

The check is done by software, not by eye. A signed PDF looks the same on screen whether its signature is sound, expired or forged, and the picture of a handwritten signature that many documents display proves nothing. What counts is the cryptographic signature inside the file and the certificate attached to it.

The person with an interest in the result is the one who receives the document and intends to act on it. eIDAS calls that person the relying party. For a law firm or an accounting practice, the natural moment is on receipt, before the document is filed, countersigned or passed on.

A validator works through a set of checks on the document, the certificate and the issuer. For a qualified electronic signature, Article 32(1) of eIDAS sets out what the process must confirm. In practice the checks run in this order.

1. The document. The validator recalculates the document's hash and tests it against the signature. Any change made after signing shows up here.
2. The signer. It reads the certificate attached to the signature and reports who it names. If the certificate carries a pseudonym, the report must say so.
3. The issuer. It traces the certificate back to the provider that issued it and looks that provider up on the EU Trusted Lists. This shows whether the provider was qualified, and whether the certificate was a qualified one, at the time of signing.
4. The certificate's status. It checks that the certificate was inside its validity period and had not been revoked when the signature was made.
5. The time. It looks for a time stamp that fixes when the signature existed. Without one, the only signing time available is the one the signer's own software recorded.
6. The device. For a qualified signature, it checks that the signature was created with a qualified signature creation device.

The question throughout is whether everything was in order at the time of signing, not on the day of the check. Article 32(2) adds that the system must give the relying party the correct result and let them detect any security relevant issues.

A signature that is advanced but rests on a qualified certificate goes through the same list without the device check, under Article 32a.

A validation report gives one of three results: passed, failed or indeterminate. The labels come from ETSI's standard on validating signatures, EN 319 102-1. The Commission's validator is one of the tools that uses them.

Passed means every check succeeded. Failed means something is definitely wrong, for example the document was altered after signing or the certificate had already been revoked. Indeterminate means the validator could not gather enough information to decide. Typical causes are a certificate that has since expired with no time stamp to show when the signature was made, revocation data that could not be retrieved, or an issuer the validator does not recognise. Indeterminate is not a rejection. It is a prompt to find out which piece of evidence is missing.

The report also states the level of the signature: qualified, advanced with a qualified certificate, or neither. Read the two together. A signature can pass every technical check without being qualified, which matters whenever the document needs the legal effect of a handwritten signature.

No validator can tell whether the person named was entitled to sign for the company, or whether the content is correct. Those remain questions for the firm.

The European Commission runs a free signature validator on the web. Upload a signed file and it returns a report with the result, the signature level and the detail of each check. It is a demonstration of the Commission's open-source validation software, so check your firm's confidentiality rules before uploading a client document to it or to any other online tool.

PDF readers also validate signatures, each against its own list of trusted issuers. A green tick in one program and a warning in another usually reflect different trust settings, not different facts about the signature.

Where the validation result itself has to stand as evidence, eIDAS provides for a qualified validation service. Under Article 33, only a qualified trust service provider may offer one, and the result it returns must bear the provider's advanced electronic signature or seal. Providers of this service are listed in the EU Trusted List browser.