An electronic signature policy is defined as a set of rules drafted into a single policy document that elucidates the terms and conditions under which an electronic signature can be created or validated.
Therefore, it is useful to be well-apprised of the following terms in regard to the electronic signature policy:
Signature Policy Issuer
It is the party that defines both technical and procedural requirements to help in creating and authenticating electronic signatures.
Signature Validation Policy
It is a part of the policy that provides technical requirements to the signer for creating a signature and to the verifier for authenticating the same.
Public Key Certificate
It includes the data that links the identity of the public key subscriber to the private key issued by the certification authority.
What are the Types of Signature Policies?
Signature policies come into two general categories:
Single Signature Transactions
A transaction only includes one signer; the policy will signify whether the single signature is valid or not.
Multiple Party Signatures
Where multiple parties are participating in a transaction.
Roles under an Electronic Signature Policy
Signature Policy Issuer
It includes legal persons or organizations that set the conditions under which the electronic signature is legally binding.
Signature Policy User
It includes natural persons who act on their own behalf or under a business role in either one of two capacities:
Signer- One who creates the electronic signature
Verifier- One who ensures the policy's validity and decides whether to accept or reject the signed transaction.
Content of an Electronic Signature Policy
The policy will envisage the required technical and procedural elements that are required to create and validate signatures with respect to their business needs:
Information pertaining to General Signature Policy
Signature policy issuer name
Signature policy identifier
Signing period
Date of issue
Field of application
Signature validation is whereupon getting the receipt, the recipient must validate the signature before moving ahead.
Signature validation information that is apt for the signature validation policy signature policy publication to make the policy available to its users signature policy archiving provides a means to authenticate electronic signatures where policy validity has expired.
Usage of Electronic Signature Policy
When mentioning a signature policy, the signer needs to quote the policys identifier, which is the hash value and hash algorithm identifier that was used.
The verifier will then get the reference and receive a copy of the policy. He will then further compare the hash with the policy received with the hash of the policy that is to be used and make a decision on whether or not to accept the electronic signature.
Electronic transactions are legally obligatory and will be treated in the same manner as if the document was signed on paper.
This is if the standards that are mentioned within the electronic signature policy used to create and verify said signature meet the required standards under the law.
