eSign Electronic Signature Service is an innovative initiative for allowing easy, efficient, and secure signing of electronic documents by authenticating signer using e-KYC services. With this service, any eSign user can digitally sign an electronic document without having to obtain a physical digital signature dongle. Application Service Providers can integrate this service within their application to offer eSign users a way to sign electronic forms and documents. The need to obtain Digital Signature Certificate through a printed paper application form with ink signature and supporting documents will not be required.

An Application Service Provider (ASP) can integrate eSign online electronic signature service so that the users of that ASP will be able to use eSign. A physical paper form/document which is currently used to obtain digital signature certificate can be replaced by its electronic form and thereby facilitate electronic signature of the signer through eSign.

ASPs who can be potential users of eSign include Government agencies, Banks and Financial Institutions, Educational Institutions etc.

eSign online Electronic Signature Service can be effectively used in scenarios where signed documents are required to be submitted to service providers Government, Public or Private sector. The agencies which stand to benefit from offering eSign online electronic signature are those that accept large number of signed documents from users.

Some applications which can use eSign for enhancing for enhancing services delivery are the following:-

• Digital Locker Self attestation
• Tax Application for ID, e-filing
• Financial Sector Application for account opening in banks and post office
• Transport Department Applicationfor driving licence renewal, vehicle registration
• Various Certificates Application for birth, caste, marriage, income certificate etc
• Passport Application for issuance, reissue
• Telecom Application for new connection
• Educational Application forms for course enrollment and exams
• Member of Parliament Submission of parliament questions

Personal digital signature certificate requires person's identity verification and issuance of USB dongle to store private key. The access to private key is securedwith a password/pin. Current scheme of physical verification, document based identity validation, and issuance of physical dongles does not scale to a billion people. For offering hassle-free fully paperless citizen services, mass adoption of digital signature is necessary. A simple to use online service is required to allow everyone to have the ability to digitally sign electronic documents.

eSign Online electronic signature service,offers applicationsa mechanism to replace manual paper based signatures by integrating this service within their applications.An eSign usercan electronically sign a form/document anytime, anywhere, and on any device. eSign servicefacilitates significantreduction in paper handling costs, improves efficiency, and offers convenience to customers.

No. The existing method of obtaining Digital Signature Certificate by submission of a paper application form to a Certifying Authority, key pair generation by applicant Certification of public key of applicant by a Certifying Authority, signature generation as and when required using signature generation tools/utilities , safe custody of key pairs on Crypto tokens by DSC holder till the expiry of Digital Signature Certificate, etc. will continue to exist along with eSign Online ElectronicSignature Service .

The Application Service Provider determinesthe suitability ofeSign Online Signature servicein their application.

In the traditional Digital Signature system, an individual is responsible for applying for a Digital Signature Certificate to CA, key pair generation and safe custody of keys. The Certifying Authorities issue Digital Signature Certificate to individuals after verification of credentials submitted in the application form. Such Digital Signature Certificates are valid for 2-3 years. Individual can affix digital signature any time during the validity of Digital Signature Certificate. The certificates are revoked in case of loss or compromise of keys. The verification of the individual’s signature requires the verification of whether the DSC is issued under India PKI and also ascertaining the revocation status of the DSC. Key pairs are stored in Crypto Tokens which complywith standards mentioned in theInformation Technology Act & Rules to prevent the duplication of keys. It is individual’s obligation for safe custody of CryptoTokens. The signatures are created using the keys certified by CA.

In the new eSign online Electronic Signature Service, basedon successful authentication of individual using e-KYC services, the key pairs generation, the certification of the public key based on authenticated response received from e-KYC services, and digital signature of the electronic document are facilitated by the eSign online Electronic Signature Service provider instantaneously within a single online service. The key pairs are used only once and the private key is deleted after one time use. The Digital Signature Certificates are of 30 minutes validity, and this makes verification simple by eliminating the requirements of revocation checking. Document that is signed using eSign will contain a valid digital signature that can be easily verified using standard methods.

Yes. Document content that is being signed is not sent in the clear to eSign service provider. The privacy of signer'sinformation is protected by sending only the one-way hash of the document to eSign online Electronic Signature Service provider. Each signature requires a new key-pair and certification of the new Public Key by a Certifying Authority. This back-end process is completely transparent to the signer.

Yes. Document content that is being signed is not sent in the clear to eSign service provider. The privacy of signer'sinformation is protected by sending only the one-way hash of the document to eSign online Electronic Signature Service provider. Each signature requires a new key-pair and certification of the new Public Key by a Certifying Authority. This back-end process is completely transparent to the signer.

Yes. The Electronic Signatures facilitated through eSign Online Electronic Signature Service are legally valid provided the eSign signature framework is operated under the provisions of Second Schedule of the Information Technology Act and Guidelines issued by the Controller. Please refer Electronic Signature or Electronic Authentication Technique and Procedure Rules, 2015 -e-authentication technique using e-KYC services.

eSign Online ElectronicSignature Service is offered by CAs.

The agency who intent to integrate eSign service should either be:

1. A Central/ State Government Ministry / Department or an undertaking owned and managed by Central / State Government, or
2. An Authority constituted under the Central / State Act, or
3. A Not-for-profit company / Special Purpose organization of national importance, or
4. A bank / financial institution / telecom company, or
5. A legal entity registered in India

The ASP can apply to eSign ServiceProviderfor integrating eSign-Online ElectronicSignature Service in their application as mentioned in the On-Boarding Guidelines. The eSign-Online ElectronicSignature Service provider allows access to ASPs after fulfilling the criteria mentioned in the On-Boarding Guidelines.

The user should have e-KYC identification Number. For OTP based authentication, the mobile number should be registered with ESPDatabase.

The communication between Application Service Provider and eSign-Online ElectronicSignature Service is operated in accordance with eSign API Specifications.

eSign APIs are designed to interact with one or more eSign Online Electronic Signature Service providers. If application provider desires to interact with only one ESP, it should use the name of the eSign Online Service provider and communication link as mentioned in the eSign API specifications. In the case of multiple eSign Online Service providers, the ASP can manage the service by local integration.

Yes, the following are the options

ASP level logon/Password authentication : Though e-KYC OTP option is relevant to environments where the risks and consequences of data compromise are low and they are not considered to be of major significance. An application level authentication is recommended for eSign Online Electronic Signature Service. How can one ensurethat the authentication to application and to eSign Service is by the same person? In the application implementation, anindividual is identified using a code or number instead of name. For example in the case of income TAX e-filing, the person is identified by aPAN number. It is a challenge for application to ensure that the individual who have logon using PAN id is the person who has signed the documents. Mapping (seeding) the individual’s application specific ID with theire-KYC identificationnumber in the ASP database is recommended to enable the authenticity of the signature.

In the application implementation, anindividual is identified using a code or number instead of name. For example in the case of income TAX e-filing, the person is identified by aPAN number. It is a challenge for application to ensure that the individual who have logon using PAN id is the person who has signed the documents. Mapping (seeding) the individual’s application specific ID with theire-KYC identificationnumber in the ASP database is recommended to enable the authenticity of the signature.

Individuals can use Digital Locker (http://digilocker.gov.in/) to store the electronic copy of their identities/Certificates/etc at a central location. The electronic documents placed in the repository of Digital Locker can be accessed or thelink can be shared for verification requirements. These electronic documents can be electronically signed (self-attestation) using eSign Online Electronic Signature Service for integrity and authenticity

Based on the verification of identity of individuals and storage of key pairs, three classesof certificates are issued in the traditional way of obtaining Digital Signatures Certificates from a Certifying Authorities. In the case of eSign Online Electronic Signature Service, the Digital Signature Certificates are issued in the following classes.

e-KYC-OTP: class of certificates is issued to individuals use based on OTP authentication of subscriber through e-KYCService.

e-KYC-Biometric -Biometric class of certificate is issued based on biometric authentication of subscriber through e-KYC servi

An individual can obtain Digital Signature Certificate from the existing DSC issuance framework and can be used to digitally sign the electronic content of choice subject to the acceptability of such class of certificate by the relying parties and the validity of the DSCs.

eSign Online Electronic Signature Service are offered to individuals by Application Service providers. In the eSign Online Electronic Signature Service, the choice of type of electronic content on which electronic signatures can be applied are limited to option provided by ASPs.

An individual can obtain Digital Signature Certificate from the existing DSC issuance framework and can be used to digitally sign the electronic content of choice subject to the acceptability of such class of certificate by the relying parties and the validity of the DSCs.

eSign Online Electronic Signature Service are offered to individuals by Application Service providers. In the eSign Online Electronic Signature Service, the choice of type of electronic content on which electronic signatures can be applied are limited to option provided by ASPs.