1. What is a valid electronic signature?

According to Article 13 of the "Electronic Signature Law", an electronic signature is deemed to be a reliable electronic signature if it meets the following conditions at the same time:

(1) The electronic signature production data is used for electronic When signing, it is exclusive to the electronic signer;

(2) The electronic signature production data is only controlled by the electronic signer when signing;

(3) Any changes to the electronic signature after signing Changes can be discovered;

(4) Any changes to the content and form of the data message after signing can be discovered.

That is, the true identity, true intention, signature has not been changed, and the original text has not been changed.

The "Electronic Signature Law"

That is to say, it is necessary to ensure that the identity of the signer is true and accurate, there is a clear expression of signing intention, and the original text of the signed document and the signature data themselves cannot be tampered with, and satisfy The above four points require a reliable electronic signature.

2. How to make the electronic contract valid?

Specifically, the electronic contract signing process needs to be implemented through technical means such as identity authentication, timestamps, and encryption algorithms. At the same time, the electronic contract platform has passed the qualification certification of authoritative organizations to ensure the legal compliance, safety and reliability of electronic contracts.

Technical means

①Real identity: First, users need to ensure that their online and offline identities are consistent before using electronic signatures. After real-name authentication through face recognition, bank four factors, etc., A digital certificate representing the network identity is issued, and only the person operating it can pass the authentication.

②True intention: After real-name authentication, each user will obtain an independent digital certificate. Each time the user signs, the user needs to perform actions to confirm the signing authority, such as facial recognition, SMS verification, signing password, etc. to complete the confirmation of signing intention.

Example of signing process (source: eSign Bao)

③ and ④: After passing the authentication, the electronic contract comprehensively applies RSA, SM2, SHA 256, SM3 and other cryptographic algorithms, complying with PADES The standard introduces timestamps to ensure that the signed content and time are solidified to achieve the purpose of anti-tampering of the original text and anti-tampering of the signature.

For example, by verifying the digital certificate of the electronic seal in an electronic contract, you can check whether the contract content has been tampered with. The forged PS picture of the official seal, as well as the tampered contract and seal, will naturally be lost. Legal effect.

Verify electronic seal (source: eSignBao)

Qualification certification

Mature electronic contract software on the market requires a complete qualification certificate. Because the electronic signature industry is a franchise industry in our country, involving information security, business secrets, etc. Therefore, this industry is regulated by various departments and the qualification requirements are very strict.

Regular electronic contract service providers need a business license stipulated by national laws to ensure the security of user information and data. Therefore, industry qualification certificates are an authoritative organization’s recognition of software service providers’ ability to ensure data security and protect privacy. For example,

Secret-related qualifications - commercial encryption product certification, Class III protection, ISO27001 information security management system, ISO27018 public cloud personal information protection management system, ISO27701 privacy information management system, etc.

Public trust qualifications - the number of CA institutions it cooperates with across the country, whether it invests in and holds CA institutions, etc.

Qualification certification example (source: eSignature)

Therefore, to meet the requirements of reliable electronic signatures in the "Electronic Signature Law", the user needs to pass the identity during the signing process. Authentication, will authentication, combined with anti-tampering technologies such as timestamps, digital certificates, cryptographic algorithms, and qualification certification from authoritative organizations ensure the compliance of the signing services provided by the platform, thereby ensuring that the signed electronic contracts have legal effect.