Miscellaneous points of interest
Advanced electronic signatures used by the Federal Administration (AES of the SG-PKI)
Advanced electronic signatures (AESs) are not regulated under the ESigA. Their characteristics depend on the specific certification service, and often there is no reliable means of verifying the identity of the signatory or signatories. Consequently, the Validator is generally unable to fully verify documents signed with an AES, i.e. to display an overall status of ‘green’. However, this is not the case with AES certificates issued by the Federal Administration (SG-PKI): the properties of these electronic signatures are well known, and in particular, verification of identity is guaranteed. For this reason, in contrast to the case of AESs offered by the private sector, the Federal Administration’s AES Validator can report an overall status of ‘green’. However, any individual or business wishing to sign a document that is to be marked by the Validator with an overall status of ‘green’ should use regulated electronic signatures (QES and seals in accordance with ESigA) rather than an AES.
Signatures under Swiss and EU law (combining signatures)
The legal and technical regulations in Switzerland and within the EU are comparable when it comes to the legal status of qualified electronic signatures (QES). However, certification service providers are recognised independently of one another in each jurisdiction, and the actual creation of a QES is carried out in a manner specific to each jurisdiction. A QES is therefore drawn up in accordance with either Swiss law or EU law, and as a result is generally only valid within the relevant jurisdiction. There is no mutual recognition of the respective QESs through an international treaty or statutory provisions.
It is possible to sign a document with a QES in accordance with Swiss law and also with a QES in accordance with EU law.
It should be noted that signature validators are generally only able to verify the validity of electronic signatures within a specific legal jurisdiction. This also applies, for example, to the Federal Validator. This means that if a document contains a QES under EU law as well as a QES under Swiss law, the Validator is no longer able to display an overall status of ‘green’.
Documents bearing an electronic timestamp only
Using a qualified electronic timestamp, a time-stamping service confirms, by means of a regulated electronic seal, that a specific piece of information existed at a specific point in time. This makes it possible to verify the integrity of the information or a document. The Validator checks such timestamps when verifying electronic signatures, in particular to ensure that they originate from a recognised certification service provider.
The Validator also checks standalone timestamps, i.e. documents that bear only a timestamp but no other qualified electronic signature (QES) or qualified electronic seal. However, the overall result is only ‘green’ when accompanied by a valid, regulated electronic signature.
e-ID
An electronic identity (e-ID) in Switzerland is digital proof of identity that is recognised by the state. It enables a person’s identity to be verified online in a clear and secure manner. It is regulated by the Federal Act on Electronic Identify and Other Electronic Credentials.
In the context of electronic signatures, the e-ID can serve as a reliable basis for identifying a person applying for an electronic signature. The e-ID therefore supports the issue of signature certificates by recognised certification service providers, and in particular the creation of qualified electronic signatures in accordance with ESigA, but is not a (single-use) signature certificate.
Single-use certificates
Signature certificates are always valid for a specific period and can be used to sign electronically within that period. Standard certificates are generally valid for 1 to 3 years; they must be stored securely during this period and may be revoked. Single-use certificates, on the other hand, are generated for each signing operation and are generally valid for only a few hours, and for no more than several hours. For practical reasons, they cannot be revoked and they do not need to be securely saved or stored; instead, they are discarded after the signing process. Single-use certificates are issued automatically by a trust service provider, usually directly during the signing process. Overall, single-use certificates enhance security, user-friendliness and flexibility in electronic signing.
Signature policies and directives, i.e. operational guidelines
Signature policies and directives, i.e. operational guidelines, set out who within an organisation is authorised to sign for what, and what requirements apply. Among other things, they define roles, responsibilities and financial limits, and generally apply to both handwritten and electronic signatures. In a digital context, it is also possible to specify which types of signature (e.g. advanced or qualified) are required for which business transactions. The guidelines often also include requirements regarding identification, authentication and the use of signature solutions, as well as rules on the standard visual presentation of electronic signatures.
These regulations are intended, among other things, to ensure that only persons with the requisite authority can enter into legally binding arrangements on behalf of a business or organisation, and that statutory requirements or internal compliance guidelines are adhered to. They also help to ensure that the person responsible for processes can be identified and their sequence can be traced back and cannot be tampered with. Overall, such guidelines ensure transparency, security and compliance when dealing with signatures.
Within the Federal Administration, Operational Guideline E018 applies [Link 35].