Digital Certificate FAQ

Are digital signatures totally sufficient from a legal point of view and can contracts be concluded via Internet without the customer providing a separate (graphic) signature?

Handwritten signatures are only necessary when both parties agree on providing them or if they are required by law. Most contracts, however, do not require them and a simple request form filled out with the computer is binding even without a digital signature because a declaration of intent has taken place. However, the problem on the Internet is that one cannot be sure that the stated data is correct. The digital signature here achieves the same as a graphic one. It is important to note, however, that "written form" by itself always refers to graphic signatures and never the digital ones.

What are Smart Cards?

Smart Cards are intelligent chip cards on which your private key is saved and never leaves the card. The signature could be created with a processor located on the card.

What are public and private keys?

A public key is one of the two keys used for asymmetric encryption. The public key is openly accessible, for instance on a public key server, and is needed to encrypt messages to its holder and to check his/her digital signatures. The private key signs the holder's outgoing messages and decrypts his/her incoming messages. The private key may only be accessed by the key holder and cannot be deduced from the public key.

What is a certificate?

A certificate is a public key that has been digitally signed by a Trust Center / a Certification Authority. A certificate proves that the key belongs to the person whose name appears on the certificate, and is therefore often referred to as "electronic ID".

The most widely used certificate formats of today are PGP and X.509. Both are supported by current browsers. A certificate consists of four parts: information on version and a serial number, the public key, the period of validity, and the Trust Center's signature.

What is a digital signature?

A digital signature is a block of data, which has been encrypted with the sender's private key to verify the authenticity of the message. The verification of the digital signature is achieved through the sender's public key.

What is revocation?

If it is not assured that only the key holder has access to his/her private key, revocation can ensure that unauthorized third parties cannot use this key.