Agrello .ID for user authentication and digitally signing documents

User authentication and digitally signing documents are now way more advanced

We are very proud to announce that with many months of recent developments we have some huge updates to our product.

IPOhub opens up European Growth Markets for all investors

IPOhub opens up European Growth Markets for all investors

Here is another example of a like-minded Estonian company looking to change the norm and practices.

IPOhub is an Estonian start-up based in Tallinn. It was founded in 2017 by Founders Aleksander and Volli Kalju and provides an investment platform for individuals, agents and companies. With it’s innovative and out-of-the-box approach IPOhub has created something great!

IPOhub announces the release of the first pan European platform for investors who wish to find, research and invest in companies across the 16 growth markets.

The platform provides users with offers and share issues from companies across these markets and combines this with historical data to get a complete picture of the investment opportunity. Once an individual finds a worthwhile prospect, they can have their identity verified and can subsequently sign subscription forms digitally.

Barriers for individuals wishing to invest in these markets up to now have been substantial.

Even experienced investors simply don’t have access to all the offers and share issues across Europe in one place. Which means trawling a variety of sources to get incomplete data. What’s more, when a good investment prospect can be found, individuals are hindered further by numerous country-based restrictions.

Something Volli Kalju, founder and investor knows all too well:

“When your opportunities are restricted by various country-based bureaucracies you ask yourself is it worth it — there are so many great companies out there worthy of investment, this surely can’t be healthy for anyone, freedom to invest should be exactly that”.

And it’s not just investors that benefit. Agents get a platform to promote their offers and reduce their paperwork, and companies get an additional channel to market themselves to potential investors.

IPOhub’s initial release is just the first leap into creating an investing environment that is balanced for both individual and institutional investors alike. Every day more offers, share issues, companies and markets are coming online.

More information can be found at www.ipohub.io.

It’s an exciting project. Stay tuned for more news!

Expanding to South Africa? Agrello was visited by the Ambassador of the Republic of Namibia

On the 23rd of May The Ambassador of the Republic of Namibia to Finland and the Baltic countries H.E. Mr Bonny Haufiku visited Agrello Office in Tallinn.

The Republic of Namibia is looking for cooperation opportunities with the purpose of digitizing the public and private sector services. The Ambassador of Namibia visited Estonian ICT companies in order to attain the experiences we have in Estonia. In addition to Agrello, also ThinnectBlockhive and SK ID Solutions introduced their technologies to the Ambassador.

The interest in Agrello’s services is very high in Namibia, that is also the reason why the meeting was held in the office of Agrello. Agrello is offering innovative solutions of electronic ID and document signing. Agrello ID is a personal self-sovereign digital identity which is powered by blockchain, supported by an advanced identification process, and protected by cryptography. Agrello signing solution allows users to automate the document signing processes while meeting the higher standards of security (eIDAs regulations). The main benefits that come with using the Agrello solutions are saving time and money, making work processes more efficient and highly secure. Agrello is using technology which ensures that none of the data could be tampered with. The solutions we offer have no restrictions when it comes to country borders — it can be used all over the world.

The visit was organised through the project called “SME Aisle” — exports of cluster of CB economic strengths shipbuilding, maritime renewable energy, automation and ICT to Namibia as a stable point to entry to the South African markets, and it was led by the project manager Vahur Valdna. The main objective of the project is to achieve sales to Central Baltics Small and Medium Sized Enterprises with joint concept using Namibia as a safe entry point to coastal South African countries (e.g. South Africa, Angola, Mozambique).

Agrello Deploys Smart Contracts for Transparent Billing in Temp-Sense’s IoT-based Cold Chain Solution

Agrello Deploys Smart Contracts for Transparent Billing in Temp-Sense’s IoT-based Cold Chain Solution

Food products supply chain is a rather complex use case. The process from a farm to a store shelf or restaurant kitchen takes time and often involves a long supply chain, where food products are handed from one party to another for storing, processing, or delivery. Without an active and reliable end-to-end monitoring solution, such supply chain can’t immediately react to adverse changes in handling conditions, and problems are only observed on the receiving end. Any break in the process, and decayed food product on a store shelf or in a restaurant kitchen goes to waste and creates compliance and reputational risks.

The Context: Temp-Sense Food Safety Compliance Solution

The online temperature monitoring system Temp-Sense includes wireless detectors installed in refrigerators and hot food counters, across the supply chain. All data that is measured is available “in the cloud” in real time and is displayed on the dashboard where the store and restaurant manager (or an internal auditor) can easily keep an eye on the processes within the entire supermarket or restaurant chain.

In this system, the IoT network service provider company Thinnect handles the sourcing and deployment of automatic IoT sensors into the Food supply chains, as well as collecting and processing the sensors’ data. Thinnect employs a specialised IoT blockchain to run the IoT service, which ensures that the sensors can’t be tampered with across the supply chain.

FoodDocs, a digital food safety and compliance expert company, uses the collected data to support supermarket and restaurant chains in assessing food safety and creation of documents required for food safety compliance.

Altogether, Temp-Sense delivers a digital solution that enables a proactive, reliable and highly efficient food safety and compliance process. Please see the blog post about Temp-Sense (used to be called ThinMoni) for more details.

Specific Supply Chain Challenges

Temp-Sense operates a PAYG business model in order to lower the barrier for adoption of IoT services in the supply chain. This business model implies that:

  • customers pay exactly for the services they have actually consumed;
  • and each participant of the chain, from carriers and storage facilities to sensor manufacturers and IoT service providers, receive their portion of the earnings as per the service billing contract.

Whilst highly beneficial for all participants, this business model presents the following specific challenges.

1. Transparent billing and attribution in a trustless environment

It is easy to see that each participant of the chain are running their own business, with their own priorities and considerations. In this naturally trustless environment, ensuring transparency of billing and attribution for all stakeholders is a challenge.

2. Billing on the level of micro transactions, at scale

In addition to the above, IoT networks are characterised by large numbers of micro devices, producing high volumes of micro readings. The challenge this poses is billing on the level of micro transactions, at scale.

Agrello Smart Billing Contract Solution

Agrello employs blockchain Smart Contract technology to address these challenges:

  • Agrello provides a framework to codify the Food Safety chain service billing contracts into Smart Contracts on blockchain;
  • subscribes to metadata about sensor readings from the Thinnect IoT blockchain;
  • executes service billing Smart Contracts on demand to produce billing and attribution reports for stakeholders.

In this particular instance, our blockchain technology of choice is Hyperledger. The key reasons for this choice are:

  • enterprise grade architecture;
  • permissioned network model;
  • high performance and transaction throughput;
  • efficient transaction endorsement policy with pluggable consensus option;
  • no dependency on any cryptocurrency;
  • no transactional costs for running transactions and queries;
  • automatic creation of end-point Rest APIs to access functionality of the solution.

A typical Hyperledger network solution consists of the following components:

  • data Model, specifying Assets and Concepts of the solution;
  • definitions of Participants of the network and their Permissions;
  • chaincode defining the business logic — IoT sensor usage billing rules in our case;
  • presentation layer — billing reports in our case.

The Billing Contract

With a bit of a simplification and focusing on the core features of the contract for the purposes of this post, the structure of the Billing Contract is as follows.

Notes on the contract structure

Worth noting that X, Y and Z are defined on the level of micro-cents, creating a highly precise cost model per unit of consumed service.

This cost structure is used by Thinnect to bill FoodDocs for the Food Safety Monitoring and Compliance service. Further, the “sharing economy” principle applies in the way that the same cost structure is applicable to Thinnect, its subcontractors, Device Manufacturers and even Agrello, to obtain and distribute a portion of proceeds from each device reading transaction.

Below, we will explain the key aspects of implementation of such contract on the example of this Provider-Consumer billing contract.

Assets, Concepts and Participants

Let’s have a look at the key entities of this contract’s network.

Consumer and Provider

Participant entities Consumer and Provider give parties permissioned access to the network and its assets through cryptographic keys, ensuring the highest degree of control and safety of confidential information.

Consumer-Provider Contract

This entity is designed to maintain records of contracts between Consumers and Providers, and is therefore implemented as an Asset. The two fundamental aspects of this entity are:

  1. set of Contract Terms, specifying the billing rules in relation to the contract;
  2. set of Devices, as deployed for the Consumer in relation to the contract.

Contract Terms

This entity is specific for this particular type of contracts. It is designed to hold the billing parameters of the contract, which in this use case are: a price per reading and a capped cost per month, dependent on the number of devices deployed to a customer location.

Device, Device Contract and Readings

One interesting aspect of this implementation is that Devices effectively work on Contracts. That is, we are not interested in metering or billing devices that are not deployed to any contract, or where the contract has expired or got terminated.

The Device entity maintains the record of all available devices and their current status, whether they are sitting in a warehouse or deployed to a customer.

The Device Contract entity maintains records of:

  • devices deployed to customer locations (one Device Contract per Device) against a Consumer-Provider contract,
  • and Readings captured from active devices performing on active contracts.

This overall structure allows for a good reusability of the model as well as for efficient updates and queries on it.

The Device Reading Transaction and Report Entities are described in the next section.

Chaincode

The key functions of chaincode in this use case are:

  • validating device reading transactions against the status of the device and the contract, before committing it as valid and billable;
  • and generating billing reports on request, based on report parameters.

Device Reading Transaction

The DeviceReadingsTransaction transaction depicted in the diagram above executes chaincode that implements the special condition of the contract — ensures that only valid readings from “ACTIVE” devices are committed as billable. Blockchain safeguards the solution from malicious transactions entering the system.

Report Entities

There are two levels of reports developed for this use case, driven by and aligned with the structure of the Billing Contract:

  • the aggregated level — total sensor readings and cost per Customer & Location;
  • and a detailed level of readings and cost per Device per Customer & Location.

The Chaincode takes the Billing Period, Customer and Location as parameters and posts a blockchain transaction which executes the following key steps:

  1. fetches collected Device Asset data for the specified Billing Period / Customer / Location;
  2. fetches applicable Contract Terms (billing rules) from the corresponding contracts in the Data Model;
  3. aggregates the fetched Device Asset data and calculates costs using the fetched Contract Terms (billing rules).

Billing Reports

In this project, we didn’t need to build a sophisticated front end solution. Instead, we’ve leveraged the Hyperledger Composer’s presentation capabilities to visualise billing reports, thus making them natively available to all permissioned network participants. We’ve also employed the Hyperledger Rest API capabilities to receive data from Thinnect’s IoT blockchain, and to expose the reporting Rest API back to Thinnect. This API provides full capabilities for building billing dashboards and generating reports where required.

A typical report looks as follows:

Roll out

Core components of the solution are packaged in Docker containers so deploying a new instance of the network or bootstrapping a new node is quite straightforward using standard tools.

Here comes another key advantage of using blockchain and Hyperledger in particular for this use case. That is, every significant party of the supply chain (or any sufficiently interest one) can bootstrap their own node on the network, thus both contributing to the overall resilience of it as well as obtaining and running their own copy of the ledger they can trust.

Summary

In this article, we’ve considered a particular type of a Supply Chain use case — Food Safety in the Cold Chain. This use case presents a number of challenges, amongst which are: the transparent billing and attribution in a trustless environment, and billing on the level of micro transactions at scale. We’ve described the Agrello solution to these challenges, based on the Smart Contract technology.

The advantages of the described solution are:

  • reliability of the process, as deployed once it can’t be tampered with;
  • transparency and trust, as any diligent stakeholder can run a node on the network and therefore have access to an up-to-date snapshot of data;
  • billing on the level of microtransactions;
  • high scalability;
  • no need for traditional reconciliations between data, contract conditions and reports, as they all live in the same environment.

Whilst this post has focused on the Food Safety use case, the solution has a wide range of applications, for example:

  • monitoring of environmental parameters in buildings;
  • monitoring of air quality in factories and facilities;
  • use of resources, such as rooms, vehicles or tools;
  • and many more.

If you see how this type of solution can be beneficial for your business, let’s talk!

Creating Contracts Is Not A Headache Anymore

Are you struggling with creating a contract? Or are you wondering if you have all the important aspects covered in your contract, whether you are renting out your real estate or offering your services to customers? Agrello can now help you out with this!

Agrello can offer you flexible contract templates you can use when creating your own contracts. By using our templates you can easily create a contract and do it quickly! We offer the most commonly used contract templates, so all you have to do is fill in your specific data. Our goal is to help you save time and energy that is often spent on creating contracts.

And perhaps we can also help you save money — you won’t necessarily always need to have a lawyer draw up a legally binding contract, instead you can use our templates*. Agrello templates are FREE OF CHARGE, you can use them over and over again, there is no limit. You can find them from the Template Store and save the favourite ones in your personal Template Library, so they are always within your hand’s reach.

*You as a contract creator are responsible for the contract, its’ requirements and accordance to your needs.

We have created customised contract templates for B2C, B2B and also C2C models. So we can help you make your life a little bit easier with both — the personal and business matters. Using our templates you can create a sales, loan or rental contract or have a NDA with your partners.

But of course the alternative of you creating a contract from scratch remains on Agrello Platform. You can save all of your favourite customised contract templates in your Template Library. So you can easily initiate a new contract whenever and wherever you need to!

Creating contracts is no longer a hassle!

Visit our Contracts Platform at https://contracts.agrello.io.

What’s The Future Of Blockchain In The Legal Industry

There’s no time frame on innovation. Some believe that blockchain technology will be everywhere in the legal industry within five years. Some think we’ll wait a decade or more to see its impact.

Timeline aside, industry experts agree that smart contracts have the best chance for mainstream adoption in the legal industry. They’re useful in firms large and small alike. It’s anyone’s guess when we’ll see industry-wide adoption. “Sooner than later” may even be too precise an estimate.

But this hypothetical future where blockchain is ubiquitous in the legal industry has several defining characteristics. All contracts are underpinned by smart, self-executing technology. Litigants settle disputes in real-time from remote locations using objective blockchain algorithms. Food vendors are legally required to track their shipments using blockchain ledgers.

The legal industry’s blockchain-enabled future may not be imminent, but now you’ll know it when you see it.

1. Charley Moore, Founder and CEO of Rocket Lawyer

Charley Moore

“The future of blockchain in law will include transparent and efficient legal transactions, as well as dispute resolution at scale, in real-time, on the blockchain.

We’ll see adoption and use of this technology not just among the most innovative, forward-thinking enterprise businesses, but also among small and midsize businesses, and even individuals. We’ll likely see increased regulation around blockchain’s use in the legal industry, which will provide critical compliance rules to sustain the trust that is essential to the growth and viability of the system.”


2. Casey Kuhlman, CEO of Monax

Casey Kuhlman

“Looking into 2019 and beyond, the legal industry is on the brink of evolution. The next step is to execute on our vision and to turn the possibilities into realities — to stop telling and start showing.

I have long said that blockchain technology may be seen by many as a fundamentally financial technology. However, I’ve always viewed it as fundamentally legal technology, because it offers the legal sector collaborative platforms and infrastructure with entirely new capabilities. It is going to be a very fun and interesting few years for the tech sector of the legal industry!”


3. Peter Buck, VP of Product Strategy at NetDocuments

Peter Buck

“Blockchain technology will be ubiquitous in the legal industry within five years, though not in the ways that most people expect. Rather than fancy new applications (although there will be some), blockchain technology is likely to be integrated into virtually all legal documents, contracts, and workflows to provide dramatically high data integrity, security, and privacy. Doing so will streamline many legal processes and lower costs.”


4. Andrew Rossow, esq, Attorney, Adjunct Cyberlaw Professor and Editor for GritDaily

Casey Kuhlman

“Smart contracts!

They are extremely useful, whether we talk about landlord-tenant law, a simple contractual relationship involving goods and services, intellectual property law, the authenticity of artwork, food safety and traceability, healthcare and pharmaceuticals, cybersecurity, or the criminal justice system.

The possibilities are endless.”


5. Matthew Shearing, Founder of BlockSense

Matthew Shearing

“Currently, our legal frameworks are reactive. We write agreements on paper and rely on people to follow the terms of their own free will. Enforcement when things go wrong costs a lot of time and money.

Distributed ledger technology provides a way for lawyers to develop proactive legal solutions for clients. Contracts are programmed and the conditions enforced themselves. Compliance can be audited by all parties, which promotes trust and prevents expensive litigation. Blockchain presents an opportunity for firms to provide innovative solutions to complex problems and begin developing new tools with which they can separate themselves from their competitors.”


6. Daniel Tarr, Associate at Duane Morris LLP

Daniel Tarr

“Blockchain is likely to become an integral part of the legal industry, whether firms lead the charge or are forced to adopt such technologies by clients and other outside forces.  The use of blockchain enables the integration of technologies that will increase efficiency, streamline common tasks, and enable lawyers to focus on more complex work.  As blockchain expands into other industries, lawyers will need to understand the use of blockchain in those industries so that they can meet client needs.  As clients embrace these technologies, they will look for law firms that are adopting similar technologies to reduce costs.”


7.  Robin Sosnow, Partner and Principal of Sosnow and Associates PLLC

Robin Sosnow

“In my opinion, blockchain will become a major player in the legal industry revolutionizing the nature of legal work. Generally speaking, it will help to automate day-to-day operations in law firms, legal departments, and other law-related institutions. For example, smart contracts will challenge law firms as to how much time and business may be generated through drafting and disputing contracts, reviewing closing documents, and performing functions that can be replaced by smart contracts. The adoption of blockchain technology, however, enables the legal industry to pursue new lines of business and differentiate its services adapted to the 21st century.”


8. Hando Rand, CEO of Agrello

Hando Rand

“Blockchain will certainly drive societies to stick more to regulations and agreed terms. Blockchain will disrupt auditing. The adoption of blockchain will reduce fraud and illegal activities, as it provides a rock-solid trail of evidence. At the same time, it does it in a fashion that significantly makes business processes quicker and more cost-effective.”


An Estonian Startup is Taking the IoT Based Food Safety Solution to the US Market

Born in Estonia and tested in Tallinn, the food safety system ThinMoni is being presented to partners in the US this week. The ThinMoni system helps restaurants, supermarkets and commercial kitchens to ensure food safety and quality. The solution provides real benefits to all food handlers, from producers to retailers. The consumers also benefit from the solution as they can be sure that the food they buy is of high quality and ultimately safe.

The ThinMoni system is already taken into use by Estonian restaurants and stores. This week Jürgo Preden, the creator of the system and manager of Thinnect, is introducing ThinMoni to partners in the US who service more than a million restaurants and hotels. “The ThinMoni system will provide peace of mind to the chef, the client and the manager of a store or a restaurant because nobody is happy if the meals served in a restaurant cause food poisoning or when the meat purchased from a food store is tainted,” said Preden, explaining the value of the ThinMoni solution. Üllar Kuhi, Chef de Cuisine of Restaurant Rucola, confirms the positive experience with the ThinMoni solution: “We service hundreds of clients per day in our restaurant and our goal is to provide good food and excellent service to our clients. The ThinMoni system assists us in doing so because we can concentrate on our core business and save time on supporting activities”.

The online temperature monitoring system ThinMoni includes wireless detectors installed in refrigerators and hot food counters, and the system also provides a thermometer suitable for measuring foods’ internal temperature. All data that is measured is available “in the cloud” in real time and is displayed on a dashboard where the quality manager (or an internal auditor) can easily keep an eye on the processes within the entire supermarket or restaurant chain. If a sensor registers a temperature outside of the desired range, the person in charge will be immediately notified. ThinMoni helps to save energy and identify any issues with refrigeration or hot display case equipment as the system also records all data for analysis.

In cooperation with the Estonian company FoodDocs, Thinnect offers an integrated solution simplifying the creation of documents required for food safety compliance. Thinnect complements FoodDocs’ digital food safety solution with automatic sensors reducing the amount of manual work. Together with FoodDocs, Thinnect services the leading retail chains of Estonia. The next step is to offer the same solution to customers on other markets. Karin Repp, one of the founders of FoodDocs, says: “Thinnect’s ThinMoni solution automates the activities needed for ensuring food safety that are currently done manually with pen and paper. In association with Thinnect we can offer an integral solution to our clients providing distinct advantages compared to our competitors.”

IoT solutions provide many challenges, one of them being the high number of devices that must be tracked to ensure correct billing between various parties. In case of ThinMoni, Thinnect and FoodDocs are cooperating with the Estonian company Agrello who offers a technology for creating and managing digital agreements. Hando Rand, manager of Agrello Ltd, says: “The digital agreements offered by Agrello are secured by blockchain technology which ensures that the client will only be billed for the goods and services they have actually bought. This is particularily important in the field of Internet of Things where the number of devices is enormous and different parties may be involved in offering a service.”

Temperature monitoring system is based on Thinnect’s well-proven technology which is being used in border patrol and smart lighting solutions in over 30 countries. Thinnect’s self-configuring technology and automated system management ensures that all temperature sensors start operation as soon as they are switched on and will work faultlessly for long years.

For additional information, please contact:

Jürgo Preden
Manager of Thinnect Ltd, one of the creators of the base technology
+372 551 5283
info@thinnect.com

The Agrello Team

Agrello Is Partnering In Europe’s First Real Estate Fundraiser Secured by Digital ID and Powered by Blockchain

A company named New Page OÜ, which uses blockchain technology to crowdfund real estate, has launched a project called “Project B11G”. It is the first of its kind real estate crowdfunding project in Europe.

Agrello is one of the partners in Project B11G. Together with New Page, Blockhive, Oblicity and CoinMetro on April 2nd, 2019 a pilot real estate crowdfunding project was launched. The project allows investors from all over the world to share in the profits of an industrial real estate development project. The B11G industrial lot is located in Tallinn, Estonia. The lot provides multifunctional spaces for small and medium sized businesses. The spaces, whether they are used as an office space, production area, showroom or for warehousing, are highly adaptable to the needs of new technologies and processes.

Agrello together with Blockhive have formed a joint venture called Tokenote, offering fundraising solution named ILP (Initial Loan Procurement). Tokenote’s first pilot was launched on January 26th, 2018 and its purpose was to fund Blockhive’s operations. It was also the first successful use-case of Agrello ID — Agrello’s digital verification system which allows people and companies to establish legally binding agreements over the blockchain. And now we have got to the point where we have Tokenote’s first third party pilot — Project B11G.

For more info visit the project’s website https://b11g.eu/ or get a quick overview from Blockhive’s blog.

You can also contact the project team directly or learn more about this project via Telegram.

What have we been up to…

We are excited to let You know that we have overhauled our website agrello.io. It has a fresh new look.

There are even more good news! Our beta version of the Agrello platform is ready! Yay!!! Our solution, consisting of Agrello ID and Agrello Contracts Platform, lets You create and sign documents with our advanced electronic signature (AdES).

Our goal is to make Your legal relationships and documents simple, self-enforcing and most importantly — keep them legally binding.

For businesses we offer Agrello Contract Widget which is supported by our platform. It allows You to create and sign digital documents and also makes managing them really easy.

The widget integrates seamlessly to Your company’s website and allows Your clients and partners to sign contracts wherever they are in the world.

We are on a mission to reduce the time and effort that is spent on preparing and signing legally binding contracts.

If You don’t have an Agrello ID yet then go ahead and
get one for free from here.

We value Your input to help us make our solutions even better!
Please let us know about Your experience by giving us feedback on our
website www.agrello.io or support@agrello.io.

About electronic and digital signatures

Legal foundations for digital signatures have existed since late 1990s. Technical implementations particularly took form of electronic signatures and became widely adopted in the due course. Whilst providing a convenient method for non-material transactions, they have since been hacked to expose user data and abuse the system, and even denied legal effect in material cases.

In this post, we will take a closer look at the advantages of digital signatures over simple electronic ones, and explain how a proper implementation of a digital signature service can be:

  • more secure, legally complete and independently verifiable,
  • compliant with existing advanced electronic signature standards,
  • very convenient for signature use and cost-efficient for enterprise use

so you never need to look back and use any other form of signature.

Despite numerous articles and definitions, there is still a bit of confusion about the differences between electronic and digital signatures. Particularly, many definitions are trying to introduce a digital signature through technical implementation aspects, which fails to capture the essence of the matter. For the avoidance of doubt, in this post we will adopt the following definitions:

An electronic signatureis an electronic sound, symbol, or process that is (a) attached to or logically associated with a contract or other record and (b) executed or adopted by a person with the intent to sign the record (following the widely accepted definition).

A digital signatureis a block of digitally encoded information that can (a) evidently represent a person’s signing intent by being uniquely linked to the person and being capable of identifying the person, and (b) effectively protect the person’s signing intent by ensuring that the person can use the digital signature under their sole control with a high level of confidence and sealing the data signed therewith in such a way that any subsequent change in the data is detectable, thus establishing © a robust verifiable link between the digital world and the real world (leveraging some parts of the eIDAS approach here).

Note that in this definition, a digital signature is essentially an electronic signature with advanced features, improving upon crucial aspects of a signature for the purposes of the increasingly digital world. And indeed, implementations usually employ cryptographic and advanced technological methods to achieve the desired level of capability.

But first things first, why do we need signatures at all?

Signature is a universally accepted way of expressively showing intent of a person in relation to a proposal, where the latter is often presented in the form of a document.

People have used various forms of signatures for many centuries. However, the modern world of global economy, fast business and electronic transactions creates additional requirements for signatures. Posting paper through post is not viable anymore due to the time that it takes. Faxes and scanners have brought us the instant transit of physical documents in a digital form, however they are still largely disconnected from increasingly digital systems and processes. Today, we need to be able to post transactions remotely, from anywhere in the world. We need to be able to execute them fast, in the moment. We need to be sure of their legal effect. And we want to be protected from fraud.

Simple electronic signatures face a profound challenge

The first wave of attempts to address electronic signature requirements has brought the emergence of services like DocuSign, HelloSign, AdobeSign and many others. Products from the e-signature space have been successfully adopted by many people and companies. However, whilst providing a good degree of efficiency, simple electronic signature solutions don’t really cover one very important aspect of a signature — the link to a real person behind it. Let’s have a closer look.

Here are the key attributes of a reliable method of showing intent, without which the method should not be used for any material transactions.

1. Representability — the ability to represent the signing person. A handwritten signature on a contract is always there as long as the paper is intact and it is very conveniently representable. Similarly, a banking payment transaction is also easily representable from bank statements, although slightly more cumbersome.

2. The act of signing should clearly show the intent to carry the obligations and rights included in the related content. While a signature does not clearly state for example “I agree to be responsible of the obligations set to me in this contract”, the principle of common practice is involved. In other words, something that is commonly accepted by the majority of people in the relevant group, is considered lawful. The fact that one’s signature expressively indicate the intent to be responsible, is just common practice. When we talk about a banking transaction, this comes from a logical connection, IF the transaction is made by the same person who is supposed to do that according to the terms. Most of simple electronic signature services use one step verification, usually a password. In many cases emails and accounts based on passwords authenticate automatically. This opens up many attack vectors to identity theft and many possibilities for a person to deny giving the signature by himself/herself.

3. Connection to the signed content beyond reasonable doubt. Handwritten signatures are usually placed in the corresponding place in the document, so there is no confusion about what the signature was meant for. In a payment though, if the statement has date and amount of a transaction and more importantly the description referring to the contract or to the bill that was made based on the contract, then there is no reasonable doubt to what content this action was connected to. Although, the other party must have proof that the person who transacted the money proving intent has previously seen the referred document and that the transaction refers to that particular one.

4. Link to a real person showing intent. This refers to the creation of a strong digital identity backed up by an identity verification process carried out by a trusted body, and is proving to be the most challenging one. With handwritten signatures, a signature sample is routinely added to one’s passport, so checking the signatory’s passport helps making sure that the person is not doing a random scribble in the signature field. However, there are no guaranteed methods of verifying a handwritten signature other than comparing it with a sample. Meantime, further below we will describe the digital signature approach which creates a strong technical link connecting the signature to the physical person.

Finally, all these elements must exist in a form of proof at the possession of the counterparty to the person who signed.

Simple electronic signature services have been able to fulfill the key requirements #1 and #2, and provide satisfactory solutions for #3 by applying elements of digital signature approach. However, classical solutions such as DocuSign, HelloSign, AdobeSign etc are still substantially lacking on the #4th element of intent, making their services too weak for use in any material transactions. In practice, the coverage of the #4th element is sometimes achieved by manually checking identity, or by referring to 3rd party services, which obviously adds complexity to the signature process. Meantime, today’s technology allows creating a reliable chain of trust to a trusted source of identity verification.

Digital signatures aka advanced electronic signatures

Proper implementation of a digital signature, which seemingly in the EU is referred to as an advanced electronic signature (eIDAS Article 26), helps improve upon simple electronic signatures in two crucial aspects:

  • reliably linking the signature to a real person (as opposed to just an abstract email address),
  • and securing the document’s integrity in such a way that the signed content can always be verified and any subsequent change to the signed content is noticeable.

We will go further and suggest that to address one of the weaknesses of the existing systems and future-proof a signature it is also crucial to ensure that:

  • even if the service provider ceased to exist, the chain of trust still independently remains as a tool for validating the signature.

Implemented this way, digital signature provides a higher degree of security and carries full provenance of signing intent in itself.

Let’s now look at how digital signatures implement the key attributes of a reliable method of showing intent.

1. Representability. The data embedded in the digital signature carries the identification information about the owner/signing person.

2. The act of signing will clearly show the intent because a digital signature can’t be issued by accident, as the owner has to consciously follow the signing procedure (e.g. enter their signature pin code) which amounts to a conscious act.

3. Connection to the signed content beyond reasonable doubt. One major advantage of digital signatures is achieved on this front through the use of cryptography and signer’s cryptographic keys to secure the document’s integrity in such a way that any change to the content subsequent to signing is detectable.

4. Link to a real person showing intent. Another major advantage comes through the ability to use cryptography and cryptographic keys to secure the identity information about the owner of the keys in such a way that it is protected from forging and can always be verified by counterparties. It is important to note that the cryptographic link to a person must trace back to the session of identity verification, which verifies the physical being of the person, the valid government issued identification document of this person, and that the person did the verification while being aware of what they were doing and what the consequences are.

Worth noting that a digital signature with the above capabilities satisfies all requirements of the legal framework to equate it to a handwritten signature.

Qualified signatures

There is a high interest in adopting digital signatures in public services. To address public services requirements, eIDASArticle 27 introduces advanced electronic signatures (we call them digital) based on qualified certificates (see eIDAS Article 28), aka qualified electronic signatures. In a nutshell, a qualified electronic signature means that the identity of a person has been previously verified by a qualified trust service provider in compliance with national laws of the member state:

  • through the signatory being physically present,
  • or through electronic identification means that comply with national laws and eIDAS Article 24,
  • or by using other identification methods recognised at national level which provide equivalent assurance in terms of reliability to physical presence (eIDAS Article 24).

The key point here is that for a valid qualified certificate, the issuing qualified trust service provider certifies that the signature belongs to the claiming person.

Although this seems to set the requirements for identity and signature services for use in the public sector, it would be ideal if the same requirements are followed in the private sector as well. A service that complies to the requirements mentioned above is at the pinnacle of trustability amongst ID and signature services.

Thereby, the classical approach implies a network of qualified trust service providers with a chain of certificates and a hierarchy of supervision. Whilst the classical approach is challenged by various initiatives such as Open Identity Exchange, the fundamental definition of a digital signature still stands.

Estonian example of Qualified electronic signatures

Estonia has been the front-runner in the most profound eID and e-signature services. There are currently 3 different models working in the country: smart card based, SIM-card based and smartphone application based. All of these models qualify to the maximum requirements of eIDAS. Estonia has shown on the regional level that it is possible to provide eID and e-signature services that comply to the highest standards, making no compromises in usability or user experience.

Conclusions

To summarise, following the requirements put down by the EU eIDAS regulation, it is possible to implement a digital signature service which is very convenient to use, highly secure and legally strong. There is no reason to use any services that compromise on security and trust any more.