Learn

Electronic trust, from hash to archive

Nine articles that take you from a SHA-256 fingerprint to a production e-signature platform: keys, certificates, HSMs, PAdES, timestamps and the law.

Start with part 1

Read in order, these articles explain how a document signed today can still be proven authentic in ten years. Each one builds only on the ones before it, and each one stands on its own if you arrive from search.

01How a digital signature works: keys and hashingTell an electronic signature (a legal notion) from a digital signature (a cryptographic mechanism)
02PKI and certificates: how a public key gets a nameExplain why a public key on its own cannot tell you who signed, and how a certificate closes that gap
03Signing keys, HSMs and PKCS#11: where a key livesExplain how a signing key should be generated, and why it must never be derived from a password
04Building a PKI: root and issuing CAs, CRLs and OCSPLay out a two-tier PKI with an offline root and an online issuing CA, and say which RFC rules and which industry practices shape it
05The signing transaction: binding consent to a documentTell authentication from identity proofing, and intent to authenticate from consent to a document
06PDF signatures and PAdES: inside a signed PDFTell a signature's visible appearance from the cryptographic signature stored in /Contents
07Timestamps and long-term validation: RFC 3161 to B-LTAExplain why a signer's clock or a PDF's claimed signing time is not evidence, and what a time-stamping authority adds
08Assurance, identity and law: what each control provesTell identity proofing from authentication, using NIST SP 800-63-4 as a vocabulary rather than a legal requirement
09Production e-signature architecture: a reference designMap the standards for server signing: ETSI TS 119 431-1 for the service, TS 119 432 for the protocols, the CSC API for the interface