Overview

What is Sign-it?

Sign-it is a software application designed to give AutoCAD users the ability to embed legally compliant electronic handwritten signatures in documents. The binding and analysis features of Sign-it allow the document recipient to check the document for modifications and ensures secure document management. This application runs on a standard Windows based desktop computer and has additional features available when used with the SignatureOne® Profile Server in a distributed application environment.

What is an electronic signature?

An electronic signature is any electronic form of affirmation, consent or agreement from an individual that is captured and stored with an electronic transaction or document. The signature must include information specific to the individual and a clear statement of the signer's intent (i.e. - that they are aware of the implications of signing and are agreeing to be legally bound by this).  

How is a signature protected in a drawing?

When an electronic signature is captured using Sign-it the signature is bound to the drawing using a cryptographic hashing algorithm. The algorithm used within Sign-it is based on the National Institute of Standards and Technology (NIST) approved Secure Hashing Algorithm (SHA-1). This algorithm is used to create a one time key based on the data in the drawing, the signatory information and the signature itself. The signature information and hashing key are also encrypted using the Triple DES 128bit encryption algorithm to prevent tampering. As a result of this process, a signature can only be validated within the original drawing it was bound to using this product.

What is binding and hashing?

An electronically created signature is attached to the drawing such that it maintains the integrity of the drawing. This is done by attaching the signature to the drawing and comparing the original version of drawing with the contents of the drawing each time it is opened. If any change is detected, the electronic signature is invalidated.  This architecture ensures that the "tamper evident" condition is satisfied by invalidating the signature if the drawing is altered. If any data in the drawing is altered after the person signs it, a permanent record of the tampering and audit trail is maintained for analysis.

The signature is encrypted with the drawing using triple DES encryption.  A hash of the drawing content is done using SHA-1 and the message digest from the hash is then encrypted.  Binding the signature to the drawing using these technologies prevents the person's signature from being electronically validated if somehow copied into any other drawing for the purpose of abusing a person's authority. All of these capabilities are important to ensure the electronic validation of a signature throughout the electronic process of a drawing.

The integration of CIC's signature technology into Adobe Acrobat, Microsoft Word and Autodesk AutoCAD assures that a user will be informed of any tampering to the data or the signature in the document or drawing.  CIC's Sign-it product family provides the user with signature capture, document binding, and signature validation.

What is SignatureOne Profile Server?

SignatureOne Profile Server (Profile Server) is a separate product from CIC which enables users of Sign-it for AutoCAD to either place their signature like a stamp into a document using a password or to authenticate the user's biometric information in a signature before allowing the signature to be placed in the drawing. 

Profile Server supports the non-repudiation  (i.e. - the inability of an individual to disclaim his or her signature) element of using electronic signatures.  User profile and signature template creation require a controlled environment to insure that passwords are administrated properly and that the enrolled information used to authenticate a user can not be altered by other users.

This server based product also supports export of stamps and encrypted signature information to allow their use when a user does not have access to SignatureOne Profile Server, or is not connected to the local network, Intranet or Internet.

Additional information about this product and its features can be found on our website. 

What is a signature stamp?

A signature stamp is a facsimile of a user's signature which is obtained using a password instead of a live signing. This stamp can be used in Sign-it but requires enrollment through the SignatureOne administration application. 

What is signature verification?

Signature verification is the real time authentication of the biodynamic or biometric information inherent to a user's signature. Sign-it captures this information during the enrollment process using SignatureOne Profile Server and stores information related to the signature in a protected network database. When selected, any subsequent signature is verified against this information prior to the signature being placed in the drawing. 

What is Ceremony®?

Sign-it captures various data needed to support the non-repudiation of an electronic document and the associated electronic signature. The data is representative of the Ceremony or process an individual would normally provide in the course of executing a transaction or document. It includes such critical data as the date/time of the transaction, claimed identity of the signatory, location, and reason for signing. These are the default Ceremony data elements that are collected during the signature process and can be modified through the preferences options of the product. 

How do I obtain additional information about Sign-it or SignatureOne Profile Server?

Additional information about these products can be found on our website or you can request specific information by completing our internet based Inquiry Form.  A representative from CIC will contact you directly for assistance.  

What is an eSeal?

An eSeal is an electronic image of a company logo, a company seal, or a personal seal.  Sign-it allows you to attach one to a signature block.  File formats supported are JPEG, TIF, BMP, GIF and PNG. 

What is a Digital ID?

A Digital ID (also known as a digital certificate) is a form of electronic credentials for the Internet. Similar to a driver's license, employee ID card, or business license, a Digital ID is issued by a trusted third party to establish the identity of the ID holder. The third party who issues certificates is known as a Certification Authority (CA).  The purpose of a Digital ID is to reliably link a public/private key pair with its owner.  Just as when a government issues you a passport it is officially vouching for the fact that you are who you say you are, when a CA issues you a digital certificate it is putting its name behind the statement that you are the rightful owner of your public/private key pair.   For more information on Digital IDs, visit VeriSign®'s website.

Sign-it uses the Digital ID to digitally sign the eSignature token. Only valid certificates at the time of signing are allowed to be used with Sign-it. No attempt is made to validate the signer's identity or check the revocation status of the certificate. Therefore, we support the claim that the certificate was valid at the time of signing.

What is an eKey?

An eKey is a USB Authentication Token, also known as a hardware USB security token.  It plugs directly into the USB port and is used in public key infrastructure (PKI) environments for secure log-on, email and web access, and file encryption.  Sign-it currently supports the iKeyTM 2032 from SafeNet, Inc.  Sign-it allows you to access the Digital ID or eSeal that are available on supported eKeys.

What's new