Ensuring the Lawful Use of Digital Signatures in Animal Science within UAE

How to eSign a document: digital signature lawfulness for Animal science in UAE

[Music] hi my name is neel kamal tyagi and i work at sectigo as a senior product manager i welcome you to sectigo's first ever identity first security summit this presentation succeeds my previous presentation which covered some of the basic concepts related to digital signatures in this presentation i will give an overview of different laws and standards that are applicable to digital signatures and i'll also delve deeper into different types of digital signatures governments businesses and lives of people in general around the world is rapidly undergoing a major transformation due to increasing technology influence there is thus an increasing demand for improving efficiency and security of information exchange involving signing and exchange of electronic documents documents as we know are core to how people work transact and communicate in their daily lives electronic signatures play a pivotal role in helping enterprises achieve this objective and enable them to take this big leap forward in their digital transformation journey quite understandably so such transformations require support and regulation from the concerned standard bodies and government authorities who are responsible for ensuring fair play between entities transacting electronically and also protecting such transactions from malicious actors every country or region thus has laws and standards that regulate individuals companies products and solutions that are involved in digital document signing these laws and standards contain mandatory requirements as well as general guidelines that all such entities products and solutions must respect and stay compliant with let us look at a few prominent standards and regulations that are well known in the digital signatures arena the adobe approved trustless program is a program that enables millions of people around the world to sign documents in adobe document cloud solutions using trusted digital signing certificates issued by certificate authorities that are included in the trust list of members within this program currently there are 80 plus members in this list and sectigo is a prominent member of this aatl program the cloud signature consortium is a global group of industry government and academic organizations committed to driving standardization of highly secure and compliant digital signatures in the cloud csc has defined an open api specification which helps ease the interoperability between digital signature solutions streamlines compliance with eSignature regulations and opens the market for uniform adoption of cloud-based digital signatures around the world sectigo is a premium member of csc the electronic signatures in global and national commerce act or e-sign act in short was signed into law on june 30 2000 in the united states it provides a general rule of validity for electronic records and signatures for transactions in or affecting interstate or foreign commerce the esign act is a federal law that allows the use of electronic records to satisfy any statute regulation or rule of law requiring that such information be provided in writing to consumers when requested e-i-diaz is an abbreviation for electronic identification authentication and trust services the abbreviation refers to the eu regulation number 910 oblique 2014 which came into effect on first july 2016. it sets out rules and guidelines for adequate level of security for electronic identification and trust services the regulation establishes a common secure and legal framework for qualified trust services and qualified trust service providers with the aim of enhancing trust in electronic transactions between businesses citizens and public authorities within the eu member states by providing cross-border recognition of electronic id and consistent rules on trust services across the eu the trust services regulated under e-i-das include those that serve electronic ids digital signatures digital seals timestamps qualified website authentication certificates or quacks and electronic registered delivery services and certificates related to those services sectigo is a qualified trust service provider and provides a range of e-i-das and pst-2 compliant digital signature certificates electronic seals and quarks as well as time stamping please do visit our website sectigo.com for further details of these and other product offerings similarly canada has pepida which is a federal canadian law that protects personal information and regulates electronic documents the other one worth highlighting on the slide is the psd2 standard which stands for the revised payment service directive and it governs e-transactions performed by financial institutions and payment service providers operating within the european union digital signatures can be broadly categorized into two types namely advanced and qualified eSignatures electronic seals are digital signatures where the signer is a legal entity such as a business or organization these come in two varieties namely advanced e-seals and qualified e-seals in addition to this banks and payment service providers within eu require some further specialized electronic seals that comply with the revised payment service directive standard or psd2 they again come in advanced and qualified varieties let us now look at each one of them in some more detail let us start with advanced electronic signatures there are four key requirements specified in article 26 of the idah's regulation that a digital signature must fulfill for it to be considered an advanced signature number one it is uniquely linked to the signatory this requirement is achieved by virtue of the signature being based on the signatories private key used to generate the signature number two it is capable of identifying the signatory this is achieved by virtue of the public digital certificate of the signatory associated with the signature since this certificate is issued by a public ca it is guaranteed that the signatories identity has been duly verified prior to issuance of certificate number three it is created using electronic signature creation data that the signatory can with a high level of confidence use under his sole control or sole discretion this signature creation data includes a signer's private key which is typically stored in a usb or hsm and which is accessible only to the signatory and requires authentication based on a pin known only to the signatory number four it is linked to the data signed there with in such a way that any subsequent change in the data is detectable as explained in my previous presentation on basics of digital certificate this is achieved by decrypting the encrypted hash value stored in the signature and comparing it with a freshly generated hash of the document if the two match it means the document has not been changed but if they don't it's an indication that the document was altered advanced eSignatures as the name suggests are more advanced than standard electronic signatures as they require an advanced digital certificate issued by a ca that is a qualified trust service provider as per idas regulation also outside of eu in general if a certificate provider is a member of adobe's approved trust list and the publicly trusted certificates issued by it are considered equivalent to advanced eSignature certificates let us now look at qualified electronic signatures which belong to the next higher class of digital signatures which are considered to be the most reliable form of digital signatures under idah's regulation a qualified electronic signature by definition is an advanced eSignature that is created by a qualified signature creation device often referred to as qscd in short and which is based on a qualified digital certificate for electronic signatures for a digital certificate to be considered as qualified certificate under idas it must be issued by a ca that is part of eu trust list of qualified trust service providers or qtsps in short also a qualified digital certificate must meet all the requirements laid out in enactus 1 of idah's regulation since qualified signatures have to be created inside a qrcd it means the private key of the signatory at all points in time should remain inside the qscd and never come out of it in clear these qr cds are highly secured devices such as usb s or hsms that are tamper resistant and tamper responsive for a signature creation device to be considered qualified it must meet all the requirements laid out in an extra 2 of the idah's regulation typically e-s and hsms that are fips 142 level 3 and common criteria eal level 4 certified are capable of meeting the requirements of qscds qualified eSignatures have the highest legal standing among all electronic signatures and they are considered equivalent to handwritten or wet signatures of the signatory in a court of law similar to advanced electronic signatures we have advanced electronic seals or advanced e-seals which are used to seal documents document ceiling is similar to document signing but instead of using a digital signature certificate in this case the digital seal certificate is used the difference between an eSignature and a e-seal is that the eSignatures belong to an individual or a natural person whereas an e-seal belongs to a legal entity such as a business or organization the requirements for advanced e-seals under idas are similar to those of advanced eSignatures as described in previous slides however since they belong to a legal entity they are often used to seal documents in an automated fashion without requiring manual action from the signatory qualified e-seals again are in the same league as qualified eSignatures a qualified ecl is an advanced ecl that is created inside a qualified seal creation device and is based on a qualified certificate for e-sales issued by a qualified trust service provider as per idas regulation qualified ecls are considered equivalent to the legal entities seal on paper in a court of law as part of a long-standing effort to increase the security privacy and reliability of electronic payments crossing the borders of eu nations the european commission developed the revised payment services directive also known as the eu directive 2015 oblique 2366 or the pst 2. this came into effect in january 2018. pst 2 covers many facets of the electronic payments in a market but notably introduces enhanced privacy and online security measures that must be implemented by banks and payment service providers doing business in the eu under psd2 digital certificates are used to identify banks and payment service providers to verify the rules for which they are licensed to encrypt communications and in some cases to provide tamper-proof sales or data or transactions due to the sensitivity of financial services transactions the psd2 regulatory technical standards rts specify that only ida certificates issued by a qualified trust service provider may be used for the identification of payment service providers the directive has the following four important goals number one to contribute to a more integrated and efficient european payments market number two to create a level playing field for payment services providers across eu number three to make electronic payments more secure and number four to provide more consistent consumer protection and manage third party access of consumer financial accounts it should also be noted that psg2 e-sales can only be issued by a qtsp such as sectigo to legal entities in the payment market that have a pst2 authorization number this is a special number issued by a national competent authority nca pst2e sales come in two varieties advanced psg2 ecls and qualified pst2 ecls these are basically advanced and qualified e-sales as explained in the previous slides which also meet certain additional requirements laid out in the revised payment service directive the number of use cases where eSignatures can be used is quite large basically any physical document that needs to be hand signed by an individual in theory can be converted to an electronic document and therefore can be signed electronically using either an advanced or qualified eSignature some practical use cases are listed in this slide they range from taxation related documents such as it returns filed by individuals or their chartered accountants with the tax authorities to quote notifications signed by a judge other examples include job offer letters signed by hr executives and new hires an nda is signed by contractors taking up assignments that require them to maintain confidentiality of information shared with them whether an advanced eSignature would suffice or a qualified eSignature is required largely depends on the nature of the signing transaction for most scenarios an advance eSignature should suffice however where the transaction demands higher levels of reliability or if the exact criticality and requirement is unclear it is safer to use qualified eSignatures to avoid the risk of invalidating the transaction this is because qualified eSignatures as explained previously are considered equivalent to handwritten signatures in a court of law electronic seals are required when documents have to be sealed on behalf of a legal entity as explained in the previous slides examples include sealing of sales invoices hr payslips press releases company memos contracts and signing of software code electronic seals are often applied on documents in an automated fashion as they do not necessarily require a natural person to take physical action to seal the document pst 2 seals are often used by banks and financial institutions for evidence stamping claim resolution and other example use cases such as sealing of bank statements of customers with this we come to the end of this presentation i hope the content presented was useful to you i encourage you to reach out to us if you have questions or feedback about the information shared in this presentation also i would like to remind that all the digital certificate types explained in this presentation can be purchased from sectigo by enterprise and retail customers as well as through our channel partners you can use the speak to us link that is found at the bottom of the left side panel of sectigo identity first security summit 2022 thank you for your time and attention and we look forward to hearing from you [Music] you