English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools annual

Global: Zendy Free Plan

Global: Zendy Tools monthly

Global: Zendy Plus monthly

3 Electronic signature is a technology-neutral collective noun. Therefore, several different implementations compose the known types of electronic signatures. Many classifications may be defined, for instance from technological and legal aspects. In reference to acceptability, legal status of a given signature seems to be the most important attribute for transaction partners in the eAdministration. Full probative force is usually required by Public Administration and it is also a need for building trust between untrusted partners. It can be achieved by the well-known qualified electronic signature. The qualified signature creation method requires a secure qualified electronic signature creation device and qualified certificate, although in many cases a simpler but still secure signature is also able to fulfil legal requirements ensuring the validity of transactions. On the citizen side, device dependency and relating costs were considered the major obstacles against overall usage of electronic signature technology between 2005 and 2015. Our paper intends to argue that creating advanced electronic signature is not impossible by using the signatory's biometric data and it may also be an optionally client-friendly, but not a device-free part of the eAdministration, beside the citizen card. 1. Can the human signature be used for signature or not? Electronic signature is a widely used and misused collective noun. Unfortunately, it has a lot of definitions, which have implied a lot of different implementations. It covers the normal (paper based) signature, which is scanned into a file, a typed name in the tail of an e-mail as well as the electronic signature which is created by cryptographically computed signature creation data stored on a secure qualified electronic signature creation device. Here we discuss electronic signatures, which are attached electronically to a document. The connection between signature and document may be both physical and logical. We have to mention that the meaning of electronic data has a tight interpretation which is used -, and a wider interpretation which is not used nowadays. The tighter meaning contains only digital electronic data, and the wider meaning contains non-digital but electronical data also (e.g. autopen [4]). There are two mainstream implementations of electronic signatures today. One is based on Public Key Infrastructure (PKI). The main idea is that the signer has two different keys combined mathematically, that is a key-pair. The first key is the private key, which is used to sign a document and it is secret for anyone else. The other key of this key-pair is the public key, as is in the name of this technology. It can be used by anyone to check whether the secret key’s owner was the person, 1 BSP&Partners Ltd., 1026 Budapest, Szilágyi Erzsébet fasor 89., bsp@bspp.hu 2 National University of Public Service, Institute of e-Government, 1118 Budapest, Ménesi út 5., erdosi.peter.kdi@ office.uni-nke.hu 3 This paper has been written with the support and within the framework of KÖFOP-2.1.2-VEKOP-15-2016-00001 Public Service Development for Establishing Good Governance: Digital Governance and Digital Government Research Program. 456 CEE e|Dem and e|Gov Days 2017 who has signed the received document or not. Two trust models apply to the PKI technology, the “Web of Trust” and the “Trusted Third Party” model. In the second model, there must be a third party who confirms that the personal key and the physical person belong together. It supposes the correct identification of the natural person. What about the second implementation? A number of companies implemented biometric signatures as a simple tool of gathering clients’ consent or acceptance. The signature creation data may be other than a public key if eIDAS regulation4 is really technology-neutral legislation. We argue in this paper that biometric characteristic or parameters can also be used as signature creation data corresponding to the “secret key” in the PKI world. In this case the signer’s biometric parameter is used (and attached to) the document. In the most widely used solutions electronic picture of the human signature is usually the only applied biometric parameter for the signature. Another is the usage of the fingerprint, voice, palm print, iris or several other known biometric attributes that authenticate a natural person who is physically present [6]. We have used biometry long time ago. The present paper extends the concept of human signature to the signature created in any appropriate electronic devices. We state there are no legal and technical obstacles to advanced biometric signatures as a valid subset of biometric signatures. In this case, electronic signature does not mean only the graphical appearance as visible on a facsimile. We argue that proper biometric signatures shall contain additional features also in connection with a human signature to fulfil the requirements of advanced electronic signature. For instance, the data of dynamism, speed and pressure recorded with a very high sampling rate are unique for everyone. There is another side of the uniqueness. Theoretically nobody can create the same signature twice or more. However, it requires applying different method for the appropriate validation processes. 2. Definitions of electronic signature We can group the definitions of electronic signature into two classes, legal and technological. We argue that both definitions can be applied to human biometric signatures. These two system of concepts are really different, legislators payed attention to use definitions in regulation be different from terms in existing technological standards. This leads to the statement that a legal definition may related to multiple technological terms, namely signature creation data may be several private keys (e.g. RSA 1024, RSA 2048, RSA 4096 [9], ECDSA 128 [2]) and a set of biometric attributes also. 2.1 Technical definitions and a classification We use the following terms in the technical meaning indicated below: 1. implementation of electronic signature: special electronic data attached to a document usually in connection with undertaking a commitment and used for the authentication of the signatory in order to enable accountability of the undertaking of the commitment. 2. human signature: a signature created by a given person by a specific tool (pen or pencil) or perhaps by a finger. 4 Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC CEE e|Dem and e|Gov Days 2017 457 3. biometric electronic signature: signature created by a human signature produced on an electronic device capable to record and process biometric data in digital form. 4. electronically saved signature: a human signature which is captured and stored by a device electronically. The most important difference between biometric electronic signature and electronically saved signature is that saved signature means only a recorded and reusable version of human signature, while biometric signature contains other biometric data characterized by the human signature, which can be processed and used for validation. In this aspect, signature of an autopen belongs to the class of electronically saved signatures. The relations between these definitions is shown below. Figure 1. Electronic Signatures and Human Signatures (source: the Authors) 2.2 Legal definitions After July 1 of 2016 the best starting point to analyse legal definitions of electronic signatures is the eIDAS Regulation in the European Union. eIDAS is the regulation for the electronic identification and trust services as issued on 23 July 2014. It repealed the Directive No. 1999/93/EC5. Between 1999 and mid of 2000 all Member States had created own slightly different legislation in national level, but all of them were replaced by eIDAS, which is mandatory for all Member States (and for all citizens) as an act. The eIDAS differentiates several levels of electronic signatures. We examine the following definitions of eIDAS: 1. electronic signature means data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign. 2. advanced electronic signature means an electronic signature which meets the requirements set out in Article 26”. Article 26 contains four requirements: (a) it is uniquely linked to the signatory, (b) it is capable of identifying the signatory, (c) it is created using electronic signature creation data that the signatory can, with a high level of confidence, use under his sole control; and (d) it is linked to the data signed therewith in such a way that any subsequent change in the data is detectable. 5 Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures 458 CEE e|Dem and e|Gov Days 2017 3. qualified electronic signature means an advanced electronic signature that is created by a qualified electronic signature creation device, and which is based on a qualified certificate for electronic signatures. Similar definitions exist regarding to seals. In technological aspect, electronic seals and electronic signatures are the same, only the types of the subject are different. Signatory has been always a natural person, who is able to create electronic signature. A legal person can make only a seal according to the eIDAS terminology. Signing for legal persons is forbidden, sealing is allowed. However, Public Administration should be familiar with both concepts because public clerks and authorities may sign and seal documents, orders, decrees and any other electronic information in daily work processes, similarly to clients. As regards seals, biometric electronic signature can be created only by humans, and the

May the advanced biometric electronic signature be applicable in public administration?