Difference between revisions of "E-Signature"

From MediaWiki
Jump to navigation Jump to search
(→‎Guidance for Non-MDOT Users: Edited FHWA Electronic Signature information)
 
(50 intermediate revisions by 6 users not shown)
Line 1: Line 1:
<center><span STYLE="font: 40pt arial;">'''Division 1 Supplemental Information'''</span></center>
+
<div style="text-align: center;">[mailto:Change?body=http://mdotwiki.state.mi.us/construction/index.php/E-Signature Email this Page]</div>
<center><span STYLE="font: 30pt arial;">'''e-Signature'''</span></center>
 
  
 +
====[[#General Information|General Information]]====
  
===[[#General Information|General Information]]===
+
In 2004 FHWA issued direction that according to the Code of Federal Regulation,[https://www.ecfr.gov/cgi-bin/text-idx?SID=c961274a08c1423164e297c9d95b4e02&node=pt29.1.5&rgn=div5 29 CFR 3.3 Part 5 Federal Contract Law Provisions] electronic signatures are defined as a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual's handwritten signature.  [https://www.fhwa.dot.gov/construction/cqit/111204dol.cfm Read FHWA Direction on Electronic Signatures] A specific type of electronic signature is digital signatures.  Digital signatures are defined as an electronic signature based upon cryptographic methods of originator authentication, computed by using a set of rules and a set of parameters such that the identity of the signer and the integrity of the data can be verified.
  
According to the Code of Federal Regulation, electronic signatures are defined as a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual's handwritten signature.   A specific type of electronic signature is digital signatures. Digital signatures are defined as an electronic signature based upon cryptographic methods of originator authentication, computed by using a set of rules and a set of parameters such that the identity of the signer and the integrity of the data can be verified.
+
An entity such as a computer user can be assigned a unique digital identification.  This digital identification is composed of a public key, a private key, and a digital certificate.  As their names suggest, the public key should be shared amongst users who wish to carry out transactions amongst themselves, while the private key should be only known by its user. The digital certificate is used within a public-key infrastructure to allow a third-party certificate authority to verify that the digital certificate is correctly associated with that particular public key.
 +
 
 +
As public keys are shared amongst a group of users, someone’s public key can be used to encrypt a document and their respective private key can be used to decrypt that document.  Confidentiality and data integrity of the sent document can be practically guaranteed assuming if the recipient is the only one who knows their private key.  Similarly, someone’s private key can be ‘embedded’ into a document to constitute an electronic signature, and the identity of the electronic signature may be verified by using that user’s public key.  
 
   
 
   
An entity such as a computer user can be assigned a unique digital signature.  This digital signature is composed of a public key, a private key, and a digital certificate.  As their names suggest, the public key should be shared amongst users who wish to carry out transactions amongst themselves, while the private key should be only known by its user.  The digital certificate is used within a public-key infrastructure to allow a third-party certificate authority to verify that the digital certificate is correctly associated with that particular public key.
 
 
If a user is assigned a digital ID, and if that digital ID is composed of a unique public and private key, then that user is associated with a unique public and private key.  As public keys are shared amongst a group of users, someone’s public key can be used to encrypt a document and their corresponding private key can be used to decrypt that document.  Confidentiality and data integrity of the sent document can be practically guaranteed assuming if the recipient is the only one who knows their private key.  Similarly, someone’s private key can be ‘embedded’ into a document to constitute an electronic signature, and the identity of the electronic signature may be verified by using that user’s public key.
 
 
{{top}}
 
{{top}}
  
 
====[[#Adoption at MDOT and Acceptable Uses|Adoption at MDOT and Acceptable Uses]]====
 
====[[#Adoption at MDOT and Acceptable Uses|Adoption at MDOT and Acceptable Uses]]====
The Michigan Attorney General’s office, in concurrence of the Federal Highway Administration, has issued a decision authorizing the Michigan Department of Transportation (MDOT) to use and accept digital signatures (see [http://www.michigan.gov/documents/mdot/MDOT_IM12-02_378056_7.pdf BOH IM 2012-02]). 
+
The Michigan Attorney General’s office, in concurrence of the Federal Highway Administration, issued a decision in 2011 authorizing the Michigan Department of Transportation (MDOT) to use and accept digital signatures.
 +
 
 +
There are many standards available for digital signatures, but MDOT currently authorizes the use of PKCS#12 files for digital identification.  This cryptographic standard requires the signer to confirm their identity and intent to sign by requiring the user enter their unique password to sign.  Starting in 2017 MDOT has selected a universal digital signature program for use by all parties/stakeholders on MDOT projects.  This digital signature program, Cosign by DocuSign is available free of charge to all stakeholders involved on MDOT projects.  In order to use this program to digitally sign a document, you must first have a digital identification (ID).  This ID can be obtained from MDOT by following the instructions on the MDOT esign page at [http://www.michigan.gov/mdot-esign MDOT E-Sign Webpage]
 +
 
  
There are many standards available for digital signatures, but MDOT currently authorizes the use of PKCS#12 files for digital identification. This cryptographic standard requires the signer to enter their unique password each time they digitally sign a document.  To digitally sign a document, you must first have a digital identification (ID).  This ID can be obtained from various certification authorities, but MDOT will primarily use Adobe as a certification authority.  [http://www.michigan.gov/documents/mdot/Setting_Up_an_Electronic_Signature_422066_7.pdf This PDF file] and [http://www.youtube.com/watch?v=pUIWvJgkw8E this YouTube video] shows how to create a digital ID on Adobe Reader.
+
You may have multiple digital signature format styles configured for different purposes. It is even possible to configure a digital signature with an “Imported Graphic” containing an image of your professional license stamp.  
  
MDOT is working on integration of electronic signatures on mobile devices.  There are several mobile applications that allow PDF files to be digitally signed using mobile devices, but as of now none have been authorized for employee use.  Employees are encouraged to submit mobile applications to the E-Sign team and to the Department of Technology, Management and Budget.  *Use these links to submit application ideas. 
 
  
[http://www.michigan.gov/documents/mdot/How_To_Add_A_Digital_Signature_Via_iPhone_422065_7.pdf This PDF]  shows off a potential app that can be used to digitally sign a PDF file on an iPhone.
+
It is important to note that for records retention and archiving purposes whenever digital signatures are used on documents, the electronic file (usually PDF) is considered the original legal document.  Printouts of the document containing digital signatures are considered copies, so the signed electronic file must be retained and follow the relevant approved records retention procedures.  MDOT will address the records storage issue through the requirement that all electronic documents must be placed in the project directory in the ProjectWise document management program.  The E-construction [http://mdotwiki.state.mi.us/construction/index.php/E-Construction wiki page] contains more information regarding ProjectWise.  
It is important to note that for records retention and archiving purposes whenever digital signatures are used on documents, the electronic file (usually PDF) is considered the original legal document.  Printouts of the document containing digital signatures are considered copies, so the signed electronic file must be retained and follow the relevant approved records retention procedures.  MDOT will address the records storage issue through the requirement that all electronically signed documents must be placed in the project directory in the ProjectWise document management program.  The [http://mdotwiki.state.mi.us/construction/index.php/E-Construction E-construction wiki page] contains more information regarding ProjectWise.  
 
 
{{top}}
 
{{top}}
  
====[[#MDOT Style Guidelines for Use of Electronic Signatures|MDOT Style Guidelines for Use of Electronic Signatures]]====
+
====[[#Guidance for Non-MDOT Users|Guidance for Non-MDOT Users]]====
MDOT electronic signatures will need to conform to the following style guidelines:
 
Adobe Software digital signature option selections:
 
*Graphic options shall be:
 
**“Name” Or “Imported Graphic” (as outlined below)
 
 
 
*Configure text shall be configured as:
 
**Uncheck the adobe “logo”
 
**Required to include: (“Name”, “Date”, “Location” and “Reason”)
 
**Optional “Distinguished Name” (includes job title)
 
**Optional for “labels”
 
**“left to right”
 
 
 
You may have multiple digital signature files configured for different purposes. It is even possible to configure a digital signature with an “Imported Graphic” (option noted above) containing an image of your scanned written signature or a scan of a professional license stamp. These are acceptable, but written signature images are not required and non-business related graphics are not acceptable.
 
 
 
 
 
Below are some Presentations on how to setup and administer electronic signatures
 
 
 
*[http://www.michigan.gov/documents/mdot/Setting_Up_an_Electronic_Signature_422066_7.pdf Setting up an Electronic Signature]
 
 
 
*[http://www.michigan.gov/documents/mdot/How_To_Add_A_Digital_Signature_Via_iPhone_422065_7.pdf How to Add a Digital Signature via iPhone]
 
  
*[http://www.michigan.gov/documents/mdot/Applying_an_Image_To_Digital_Signature_422061_7.pdf Applying an Immage to a Digital Signature]
+
External users will follow the same instructions for obtaining a digital ID for use to digitally sign documents shown on the MDOT esign page at [http://www.michigan.gov/mdot-esign MDOT E-Sign Webpage]
  
*[http://www.michigan.gov/documents/mdot/Trusting_and_Validating_a_Digital_Signature_422068_7.pdf Trusting and Validating a Digital Signature]
+
Please note as of Spring 2017 the MDOT 5600 form for digital signature validation is no longer required.
  
 +
MDOT will accept FHWA electronic signatures that use digital certificates issued by "U.S. Department of Transportation Agency CA."
 +
 
 +
<div style="text-align: right;">[mailto:Change?body=http://mdotwiki.state.mi.us/construction/index.php/E-Signature Email this Page]</div>
 
{{top}}
 
{{top}}
  
===[[#Using Adobe Reader to Digitally Sign|Using Adobe Reader to Digitally Sign]]===
 
 
Adobe Reader(tm) can be used to sign forms which are enabled for electronic signature.  The video below provides a demonstration on how to set up and sign a document digitally using Adobe Reader(tm).
 
 
{{#ev:youtube|pUIWvJgkw8E|350|center|How to Digitally Sign a document with Adobe Reader}}
 
 
 
{{top}}
 
  
 
[[Category: Construction Manual]]
 
[[Category: Construction Manual]]
 +
[[Category: Division 1]]
 +
[[Category: Division 1 Supplemental]]

Latest revision as of 13:20, 24 May 2021

Email this Page

General Information

In 2004 FHWA issued direction that according to the Code of Federal Regulation,29 CFR 3.3 Part 5 Federal Contract Law Provisions electronic signatures are defined as a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual's handwritten signature. Read FHWA Direction on Electronic Signatures A specific type of electronic signature is digital signatures. Digital signatures are defined as an electronic signature based upon cryptographic methods of originator authentication, computed by using a set of rules and a set of parameters such that the identity of the signer and the integrity of the data can be verified.

An entity such as a computer user can be assigned a unique digital identification. This digital identification is composed of a public key, a private key, and a digital certificate. As their names suggest, the public key should be shared amongst users who wish to carry out transactions amongst themselves, while the private key should be only known by its user. The digital certificate is used within a public-key infrastructure to allow a third-party certificate authority to verify that the digital certificate is correctly associated with that particular public key.

As public keys are shared amongst a group of users, someone’s public key can be used to encrypt a document and their respective private key can be used to decrypt that document. Confidentiality and data integrity of the sent document can be practically guaranteed assuming if the recipient is the only one who knows their private key. Similarly, someone’s private key can be ‘embedded’ into a document to constitute an electronic signature, and the identity of the electronic signature may be verified by using that user’s public key.

[top of page]


Adoption at MDOT and Acceptable Uses

The Michigan Attorney General’s office, in concurrence of the Federal Highway Administration, issued a decision in 2011 authorizing the Michigan Department of Transportation (MDOT) to use and accept digital signatures.

There are many standards available for digital signatures, but MDOT currently authorizes the use of PKCS#12 files for digital identification. This cryptographic standard requires the signer to confirm their identity and intent to sign by requiring the user enter their unique password to sign. Starting in 2017 MDOT has selected a universal digital signature program for use by all parties/stakeholders on MDOT projects. This digital signature program, Cosign by DocuSign is available free of charge to all stakeholders involved on MDOT projects. In order to use this program to digitally sign a document, you must first have a digital identification (ID). This ID can be obtained from MDOT by following the instructions on the MDOT esign page at MDOT E-Sign Webpage


You may have multiple digital signature format styles configured for different purposes. It is even possible to configure a digital signature with an “Imported Graphic” containing an image of your professional license stamp.


It is important to note that for records retention and archiving purposes whenever digital signatures are used on documents, the electronic file (usually PDF) is considered the original legal document. Printouts of the document containing digital signatures are considered copies, so the signed electronic file must be retained and follow the relevant approved records retention procedures. MDOT will address the records storage issue through the requirement that all electronic documents must be placed in the project directory in the ProjectWise document management program. The E-construction wiki page contains more information regarding ProjectWise.

[top of page]


Guidance for Non-MDOT Users

External users will follow the same instructions for obtaining a digital ID for use to digitally sign documents shown on the MDOT esign page at MDOT E-Sign Webpage

Please note as of Spring 2017 the MDOT 5600 form for digital signature validation is no longer required.

MDOT will accept FHWA electronic signatures that use digital certificates issued by "U.S. Department of Transportation Agency CA."

Email this Page

[top of page]