- A digital signature is a type of electronic signature that uses cryptographic technology to verify the signer and protect the integrity of a digital document.
- Digital signatures use public key cryptography. A private key creates the signature, while a public key allows others to verify it.
- In Singapore, the Electronic Transactions Act (ETA) provides the legal framework for electronic signatures and sets out specific requirements for Secure Electronic Signatures.
- For Singapore businesses handling both local and cross-border documents, Mekari Sign supports Singpass signing workflows and certificate-based digital signing with GlobalSign.
Business documents often need signatures from employees, customers, suppliers, or other parties working from different locations. Contracts, employment documents, procurement records, and financial agreements can all be signed digitally when the process provides the level of identity and document assurance the transaction requires.
A digital signature uses cryptographic technology to connect a signer with a specific electronic document. This allows the recipient to verify the signature and detect whether the document has been changed after signing.
For businesses in Singapore, there is also a legal dimension to consider. The Electronic Transactions Act 2010 (ETA) provides the legal framework for electronic transactions and includes specific provisions for Secure Electronic Signatures.
What Is a Digital Signature?
A digital signature is a type of electronic signature that uses cryptographic technology to verify the authenticity and integrity of a digital document or electronic record.
Unlike a scanned image of a handwritten signature, a digital signature is not simply a visual mark placed on a document. It creates a mathematical link between the signer and the document, allowing the recipient to check whether the signature is valid and whether the document has changed after signing.
Digital signatures commonly use Public Key Infrastructure (PKI), which connects cryptographic keys with digital certificates and an identified signer. The Sign with Singpass documentation explains how this model is used to create and verify digital signatures.
How Does a Digital Signature Work?
A digital signature combines several technical elements, including a cryptographic hash, a private key, a public key, and a digital certificate. The process can be understood in four stages.
1. The document is hashed
The signing system generates a cryptographic hash from the document. A hash is a fixed-length representation of the document’s content. Changing even a small part of the document produces a different hash.
The hash gives the signing system a way to represent the document’s content during the signing and verification process.
2. The private key creates the signature
Digital signatures use a pair of mathematically related cryptographic keys. The private key is kept secret and is used to create the digital signature.
During signing, the document’s hash is used with the private key to generate the signature. The private key should remain under the control of the authorised signer or signing system.
The Cybersecurity and Infrastructure Security Agency describes the same basic model, with the private key used to generate a digital signature and the corresponding public key used for verification.
3. The digital certificate verifies who the public key belongs to
A digital certificate verifies that a public key belongs to the signer identified in the certificate. It contains information about the certificate holder and their public key, and is issued by a trusted Certificate Authority (CA).
When a recipient verifies a digital signature, they can check the certificate to confirm the signer’s identity and the trust behind the public key.
4. The recipient verifies the signature
When the recipient opens the signed document, the signing software or PDF reader can check the signature and certificate information.
The public key is used to verify the digital signature, while the document’s current hash is checked against the information associated with the signature.
If the document has been modified after signing, the verification process can detect the change and the signature may be shown as invalid.
What Are Private and Public Keys in a Digital Signature?
Digital signatures use two mathematically related cryptographic keys: a private key and a public key. The private key is used to create the digital signature, while the public key is used to verify it.
The private key needs to remain under the control of the authorised signer or signing system. The public key, on the other hand, can be shared with anyone who needs to verify the signature. Together, the two keys allow a recipient to check whether a digital signature was created using the corresponding private key.
| Key | Purpose | Access |
|---|---|---|
| Private key | Creates the digital signature | Kept secret and controlled by the signer or signing system |
| Public key | Verifies the digital signature | Can be shared with recipients and verification systems |
The Singpass signing model provides a practical example. Its documentation explains that the private key is kept within the Singpass app, while the public key forms part of the signing certificate used for verification.
The two keys perform different jobs. The private key creates the signature, while the public key lets another party verify it without gaining access to the private key.
What Is the Role of a Digital Certificate?
A digital certificate helps connect a public key to an identified person or organisation. This gives the recipient more information about whose key is being used when a digital signature is verified.
A Certificate Authority issues the certificate and establishes the relationship between the certificate holder and the public key. The certificate then becomes part of the trust chain used during verification.
This is also why Certificate Authorities matter in digital signing. The same trust infrastructure can be used to verify the identity behind a certificate-based signature. Lexagle’s explanation of digital signatures covers this relationship between certificates, identity, and signature verification in a business context.
Are Digital Signatures the Same as Encryption?
No. Digital signatures and encryption use related cryptographic concepts, but they solve different problems.
| Technology | Main purpose | Typical key use |
|---|---|---|
| Digital signature | Verify authenticity and document integrity | Private key creates the signature, public key verifies it |
| Encryption | Protect information from unauthorised access | Cryptographic keys protect and recover encrypted information |
Proton’s explanation of digital signatures also separates the two concepts. A digital signature helps verify the signer and detect changes to the signed data, while encryption protects the confidentiality of information.
What Makes a Digital Signature Secure?
Signer authentication
The signing process can use identity verification and authentication controls to establish who is creating the signature.
Document integrity
The signature is cryptographically linked to the document. If the document changes after signing, the verification process can detect the modification.
Private key protection
The private key must remain protected because it is used to create the signature. Unauthorised access to that key can compromise the trust placed in signatures created with it.
Certificate trust
A digital certificate helps recipients determine who the public key belongs to. A trusted Certificate Authority provides the certificate infrastructure used to establish that relationship.
Are Digital Signatures Legally Recognised in Singapore?
Singapore’s Electronic Transactions Act 2010 provides legal recognition for electronic records, signatures, and contracts, subject to the requirements and exclusions set out in the legislation.
The ETA also sets out specific requirements for Secure Electronic Signatures. Under Section 18, an electronic signature can qualify as a Secure Electronic Signature when the applicable procedure allows it to be verified as unique to the signer, capable of identifying the signer, created under the signer’s sole control, and linked to the electronic record so that a change to the record invalidates the signature.
Section 19 provides legal presumptions for Secure Electronic Signatures. In proceedings involving such a signature, the law provides that the signature is presumed to belong to the person to whom it correlates and to have been applied with that person’s intention to sign or approve the electronic record, unless evidence shows otherwise.
What Is a Secure Electronic Signature (SES)?
A Secure Electronic Signature is an electronic signature that meets the requirements set out under Singapore’s ETA.
Sign with Singpass states that signatures created through its service are regarded as Secure Electronic Signatures under the ETA. The service combines identity authentication through Singpass with digital signing technology.
The distinction matters when a business needs stronger evidence around the signer and the integrity of the signed record. The appropriate signing method still depends on the transaction and the requirements that apply to it.
Are All Documents Covered by the ETA?
No. The ETA contains exclusions in its First Schedule, so businesses should check the relevant document and transaction before relying on its electronic signing provisions.
Where a document falls within a regulated or excluded category, the applicable legal requirements should be reviewed before an electronic signing process is selected.
What Is the Difference Between a Digital Signature and an Electronic Signature?
An electronic signature is a broader concept that covers electronic methods used to indicate a person’s intention to sign. A digital signature is a specific type of electronic signature that uses cryptographic technology.
The difference matters because the signing method can affect identity verification, document integrity, and the level of assurance available to the parties.
| Aspect | Electronic Signature | Digital Signature |
|---|---|---|
| Definition | Electronic data used to indicate intent to sign | A type of electronic signature that uses cryptographic technology |
| Signing method | Can use different electronic methods | Uses cryptographic keys and related certificate infrastructure |
| Identity assurance | Depends on the authentication method and workflow | Can be linked to a digital certificate and verified identity |
| Document integrity | Depends on the technology and controls used | Cryptographically linked to the signed document |
| Singapore legal context | Subject to the applicable requirements and transaction | Can qualify as a Secure Electronic Signature when the ETA requirements are met |
When Do Businesses Use Digital Signatures?
Digital signatures are useful when a business needs remote signing with stronger controls around signer identity and document integrity.
Employment documents
HR teams can use digital signatures for employment contracts, offer letters, policy acknowledgements, and other employee documents that require approval or acceptance.
Business contracts
Sales and legal teams can use digital signatures for customer agreements, non-disclosure agreements, service agreements, and supplier contracts.
Procurement documents
Procurement teams can use digital signatures for vendor agreements, supplier onboarding records, and other documents that require approval from authorised stakeholders.
Financial and insurance documents
Financial agreements, declarations, and insurance-related records may require stronger identity and document integrity controls depending on the transaction.
Cross-border agreements
Singapore businesses that work with regional offices, international suppliers, or overseas customers may need a signing method that can be verified through recognised certificate and trust infrastructure.
How Should Businesses Choose a Digital Signature?
The appropriate signing method depends on the document, signer, location of the parties, and legal or business requirements.
| Business requirement | What to consider |
|---|---|
| Singapore-based signer | Consider identity authentication and signing through a Singapore digital identity ecosystem |
| Signer outside Singapore | Consider certificate-based signing and how the receiving party will verify the signature |
| Legal or high-value document | Review applicable legal requirements, identity assurance, document integrity, and audit records |
| High-volume signing | Look for document tracking, approval workflows, bulk signing, and centralised records |
Before choosing a platform, check how signers are authenticated, how certificates are issued and validated, how document changes are detected, and what evidence remains after signing.
How Does Mekari Sign Support Digital Signing in Singapore?
Singapore businesses can have different signing requirements depending on who signs the document and where the other parties are based.
Singpass for Singapore signing
For supported Singapore workflows, Mekari Sign allows documents to be signed through Singpass. The document creator prepares and sends the document through the platform, while the signer completes the authentication and signing process through Singpass.
This approach can be useful when a business needs to connect the signing process with Singapore’s national digital identity ecosystem. Signatures created through Sign with Singpass are regarded as Secure Electronic Signatures under Singapore’s ETA.
GlobalSign for cross-border signing
Documents involving parties outside Singapore can require a different trust setup. Mekari Sign supports digital signatures using certificates issued by GlobalSign for these signing scenarios.
GlobalSign is included in Adobe’s Approved Trust List (AATL), allowing supported Adobe products to recognise certificates that are part of that trust infrastructure. This can help when a digitally signed PDF needs to be reviewed or verified by an overseas recipient using Adobe Acrobat or Reader.
For a Singapore company working with regional offices, international suppliers, or overseas customers, having both local and cross-border signing options can reduce the need to run separate signing processes.
What Should Businesses Check Before Using a Digital Signature?
Before using a digital signature, check whether the document can be signed electronically, how the signer is authenticated, how the signature will be verified, and what records are retained after signing.
- Document requirements. Check whether the document can be signed electronically and whether any legal or contractual requirements apply to the transaction.
- Signer authentication. Consider how the signer will be identified and whether the verification method provides the level of assurance the transaction requires. For a Singapore-based signer, this may involve a workflow that uses Singpass.
- Signature verification. Check how the recipient will verify the signature after signing. Certificate-based trust can matter when documents are shared with external parties or across borders.
- Records after signing. Review whether the signing process keeps evidence such as signature status, document integrity checks, and signing records that can be referred to later.
These considerations become more relevant when a business works with both Singapore-based and overseas signers. A local transaction may use an identity-based signing workflow, while a cross-border document may require certificate trust that the receiving party can verify in their own software environment.
The signing setup should therefore match the document, the parties involved, and how the signed record needs to be verified afterwards.
Digital Signatures for Local and Cross-Border Business Signing
Digital signatures combine cryptographic technology, identity verification, and certificate-based trust to help businesses verify who signed a document and whether its contents have changed. In Singapore, the Electronic Transactions Act also provides a legal framework for electronic signatures, including specific requirements for Secure Electronic Signatures.
The right signing method depends on the document, the parties involved, and how the signed record needs to be verified. Singapore businesses may need different approaches for local and cross-border transactions, particularly when the parties require different identity or certificate trust mechanisms.
Mekari Sign supports these different signing requirements in one platform. Singapore businesses can use Singpass for supported local signing workflows, while GlobalSign-issued certificates with AATL trust support certificate-based signing for documents involving overseas parties.
