Electronic signatures vs digital signatures: what the difference is

"Electronic signature" and "digital signature" are used interchangeably in marketing and mean different things in law and engineering. One is a legal category: any electronic mark adopted with intent to sign. The other is a cryptographic technique: a mathematical proof, made with a private key, that a specific person or organisation signed specific bytes. Understanding the difference tells you what level of assurance you are actually getting, and whether you need more.

Two words, two kinds of thing

Electronic signature: a legal category

Every e-signature law defines the term broadly on purpose. The US ESIGN Act: "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record" (15 U.S.C. §7006(5)). The EU's eIDAS: "data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign" (Article 3(10)). Canada's PIPEDA: "a signature that consists of one or more letters, characters, numbers or other symbols in digital form incorporated in, attached to or associated with an electronic document".

Notice what these definitions do not say: nothing about cryptography, certificates or technology. A typed name is an electronic signature. So is a certificate-based digital signature. The category is about the legal act of signing, and its strength as evidence depends on everything recorded around it: who was invited, whether they consented, when they acted, from where, and whether the document changed afterwards. That is why audit trails matter so much for electronic signatures: they supply the attribution and integrity that the signature image alone does not.

Digital signature: a cryptographic technique

A digital signature in the technical sense is produced by asymmetric cryptography. The signer holds a private key; the matching public key is published in a certificate issued by a certificate authority that has checked the signer's identity to some standard. To sign, software hashes the document and encrypts the hash with the private key. Anyone can decrypt the result with the public key and compare it with a fresh hash of the document: if they match, the document is exactly what was signed, and it was signed by whoever controls that private key.

This gives two strong properties: integrity (change a byte and the check fails) and attribution to a key. Whether the key belongs to the person named depends on how carefully the certificate authority checked their identity and how carefully the person guards the key. That is what the "qualified" level in eIDAS regulates: qualified trust service providers, audited identity checks and secure signature-creation devices such as smart cards or remote HSMs.

How they relate

A digital signature is one way of making an electronic signature, generally the strongest. Picture nested circles: all digital signatures used to sign documents are electronic signatures; most electronic signatures are not digital signatures. The confusion comes from vendors who call their click-to-sign products "digital signature" software, and from the word "digital" meaning "on a computer" in everyday speech.

The practical point is that the legal effect does not depend on which circle you are in for ordinary documents. The law treats a typed name and a certificate-based signature alike in principle ("shall not be denied legal effect"); the difference is in how easily you can prove attribution and integrity if challenged, and in the few cases where a law specifically requires the qualified level.

SES, AES and QES: eIDAS's three levels

The EU regulation (retained in the UK) grades electronic signatures by the assurance behind them, and the grades are a useful vocabulary everywhere:

• Simple electronic signature (SES). Any electronic signature meeting the basic definition. Cannot be denied legal effect merely for being electronic or not qualified (Article 25(1)).
• Advanced electronic signature (AES). An electronic signature that is uniquely linked to the signatory, capable of identifying them, created using signature-creation data the signatory can use under their sole control, and linked to the signed data so that any subsequent change is detectable (Article 26). These properties are usually delivered with digital-signature technology, but the regulation describes the properties, not the technology.
• Qualified electronic signature (QES). An AES created by a qualified signature-creation device and based on a qualified certificate (Article 3(12)). It has the equivalent legal effect of a handwritten signature and is recognised across all member states (Article 25(2) and (3)).

Scotland's Requirements of Writing Act uses the same ideas to decide when an electronic document is self-proving; Canada's PIPEDA has "secure electronic signature" for the cases where federal regulations demand more than the basic kind.

Digital signatures inside PDFs

The PDF format can carry certificate-based signatures (the PAdES profile of eIDAS). Adobe Acrobat and Reader show a blue banner and a signature panel for these, and warn if the document has been changed since signing or the certificate is not trusted. Each signature covers the document up to that point, so multiple signers can sign in turn and each later signature covers the earlier ones. When you see "certified by" or "digitally signed by" in a PDF viewer, that is what is in play.

A PDF completed by an audit-trail-based tool is different: the signatures are images and text flattened into the page content, and integrity is proved by comparing the file's hash with the hash recorded at completion, not by a certificate check in the viewer. Both approaches detect tampering; the certificate approach does it inside the file, the hash approach does it against an external record (and a public verification page). The guide on verifying a signed contract covers both.

Where AiresDocs sits

AiresDocs produces electronic signatures (SES) with an advanced-style evidence package: unique invitations to named addresses, optional access codes, an explicit consent record, an append-only event log with timestamps, IP addresses and user agents, SHA-256 hashes of the original and final files, and public verification. It uses hashing, a cryptographic primitive, for integrity; it does not issue personal certificates or apply PKI signatures in the signer's name, so it is not a qualified signature service and does not claim to meet all of Article 26's "sole control" wording in the certificate-based sense. For the law country by country, see the legal-validity page.

Which one do you need?

Most small businesses need the first row, all of the time, and the second row occasionally. If you find yourself needing the third row regularly, you need a qualified trust service provider rather than a general e-signature tool.

This guide explains how electronic signature law works in general terms and links to the primary sources. It is not legal advice: rules differ by country and document type and they change. For a specific transaction, ask a qualified lawyer in the relevant jurisdiction. Spotted something out of date? Email support@airesdocs.com and we will check it against the source.