0

GnuPG (GPG) has the ability to both digitally sign and encrypt things (things being messages, documents, files, etc.). Is a public-key signature legally valid?

If so, do the public keys need to be published on all key servers to remain legally effective? Or can they be posted on just one (some key servers such as the new keys.openpgp.org servers which use the Hagrid system don't propagate to older servers).

Improve this question
0

2 Answers 2

Reset to default
1

An electronic signature does not have to be cryptographically based at all to be legally valid in law. There are no US laws that I can find specifying this level of detail on what makes an electronic signature valid. A particular contract might specify what key servers are requited.

The Law of E-Signatures in the United States and Canada (an article published by the law firm of Baker And Mckenzie) says:

The E-Sign Act is a federal law that applies to interstate commerce, namely transactions across states of the United States and with foreign nations. ... UETA provides a framework for states to enact state law concerning the enforceability of e-signatures and the validity of electronic records. Forty-seven states and the District of Columbia, Puerto Rico and the US Virgin Islands have adopted some form of UETA.

In general terms, both the UETA and the E-Sign Act define an "electronic signature" as "an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record" and an "electronic record" as a record that is "created, generated, sent, communicated, received, or stored by electronic means". UETA and the E-Sign Act provide that: (a) a record or signature may not be denied legal effect or enforceability solely because it is in electronic form; (b) a contract may not be denied legal effect or enforceability solely because an electronic record was used in its formation; (c) if a law requires a record to be in writing, an electronic record satisfies the law; and (d) if a law requires a signature, an electronic signature satisfies the law.

15 U.S. Code § 7001 (part of the ESIGN act) provides that:

(a) In generalNotwithstanding any statute, regulation, or other rule of law (other than this subchapter and subchapter II), with respect to any transaction in or affecting interstate or foreign commerce—

(a) (1) a signature, contract, or other record relating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form; and

(a) (2) a contract relating to such transaction may not be denied legal effect, validity, or enforceability solely because an electronic signature or electronic record was used in its formation.

Improve this answer
3
  • Note that nothing in this says anything about cryptography. You can electronically sign a document by typing "signed Kris Matrix" at the bottom. Crypto provides stronger evidence, but doesn't change anything fundamental from a legal perspective.
    – Paul Johnson
    Commented Jan 28, 2021 at 22:17
  • 1
    @Paul Quite true. I believe that I said as much in the answer. The law could specify a public/private key system as the way to provide an electronic signature, but it does not. Almost any method will do as long as it recognizably indicates an intention to sign the document or record. It need not be particularly secure. I think that the law is similar in many other jurisdictions.
    – David Siegel
    Commented Jan 28, 2021 at 22:22
  • We recently had to submit a signed document. The instructions said to print it, sign it, and mail it, — or — edit the file, fill in the signature line with my name in italics, and e-mail it. It wasn't for money, but it seems like not much of a requirement. I guess the italics proves that I read the instructions and understood that it represents my signature and not simply my name. And, for me to dispute that it was my signature I'd have to perjure myself, so perhaps that's good enough.
    – Ray Butterworth
    Commented Jan 29, 2021 at 1:49
1

It depends on the use

Docusign (who are in the business of E-signatures has a pretty good summary:

Use cases where an SES is typically appropriate include:

  • HR documents, such as employment contracts and other new employee onboarding processes
  • certain commercial agreements, including NDAs, procurement documents, sales agreements certain consumer agreements, including terms and conditions of sale
  • certain real estate documents, including lease agreements, purchase and sales contracts; other related documentation for residential and commercial real estate
  • non-exclusive license of intellectual property

Use Cases That Are Not Typically Appropriate for Electronic Signatures or Digital Transaction Management

Use cases that are specifically barred from digital or electronic processes or that include explicit requirements, such as handwritten (e.g. wet ink) signatures or formal notarial process that are not usually compatible with electronic signatures or digital transaction management.

  • statutory declarations requiring a witness (excluded from ETA)
  • powers of attorney in certain States/Territories (Powers of Attorney Act 2014 (Vic) s 33)
  • wills, codicils and other testamentary instruments (excluded from ETA and notarization required by Succession Act 2006 (NSW))
  • bills of exchange
  • the signature, lodgement, service and filing of documents in connection with legal proceedings in certain States/Territories
  • certain documents under legislation relating to health insurance, life insurance and general insurance
  • certain documents, notices, and consents used in connection with the provision of credit related services under the National Consumer Credit Protection Act 2009 (Cth) transfers of intangible property, such as intellectual property
  • official Commonwealth documents such as passports

I will also add that certain documents to be executed by corporations such as loans and guarantees must normally have wet-ink signatures but the law has been temporarily amended during the current pandemic to allow E-signing - this may become permanent. Similarly, loan guarantees have been found to be unenforcable when they have been E-signed.

Where they are valid, they do not need encryption.

Improve this answer
1
  • Note that Docusign, as a provider of e-signature services, is not unbiased in the matter. They are a major player in this field, indeed I have used their services. Some of those exceptions list above would not apply in some other countries, such as the US.
    – David Siegel
    Commented Jan 28, 2021 at 23:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .