How secure is an e-signature? The cryptography explained

An e-signature produced by a reputable platform like SignBolt is mathematically more secure than a wet-ink signature. Here's why.

The cryptographic primitives

Every PAdES signature uses three pieces:

1. Hash function (SHA-256) — produces a 256-bit fingerprint of the document. Changing one byte of the document changes ~128 bits of the hash on average. Finding two documents with the same hash is ~2^128 operations — not feasible even with all the world's computing power for billions of years. 2. Asymmetric cipher (RSA-2048 or ECDSA-P256) — binds the hash to the signer's identity. Breaking RSA-2048 requires factoring a 617-digit number. The current record is factoring a 250-digit number with massive computational effort. 3. Timestamp authority (RFC 3161) — an external trusted party signs the signature with their own certificate, proving when the signature was made.

How forgery would work (and why it doesn't)

To forge a signature on a document, an attacker needs one of:

• The signer's private key — physically stored on the signer's device or HSM. Never transmitted. Stealing it requires compromising the device.
• A hash collision — find a different document that produces the same SHA-256 as the real one. Infeasible.
• A compromised CA — trick the CA into issuing a fraudulent certificate for the signer. Possible but rare; CAs have heavy audit requirements and revocation systems.
• Quantum computing — a sufficiently large quantum computer could break RSA via Shor's algorithm. Current quantum computers can't factor numbers larger than ~35 bits. RSA-2048 is 2048 bits.

The real attack surface

Cryptography rarely fails; endpoints do. Realistic attacks:

• Phishing — attacker tricks signer into signing a malicious document
• Account takeover — attacker compromises the signer's email and signs as them
• Session hijacking — attacker steals the active signing session
• Compromised device — malware intercepts the signing flow

Mitigations:

• Multi-factor authentication (hard)
• Document preview before signing (SignBolt does this)
• IP / device fingerprinting in the audit trail
• ID verification for high-stakes signatures

How secure is SignBolt specifically

SignBolt uses:

• SHA-256 for hashing
• RSA-2048 or ECDSA-P256 for signatures (configurable)
• TLS 1.3 for transport
• AES-256-GCM for at-rest encryption of in-flight documents
• RFC 3161 timestamps from a qualified TSA

The cryptographic posture matches or exceeds DocuSign, HelloSign, and Adobe Sign.

The threat model that beats all crypto

The one attack crypto can't stop: a signer who signs and then denies it. Their private key was used, their identity verified, the timestamp proves when — but they claim "I didn't sign that, someone must have gotten my credentials."

Defense: strong MFA at signing + video witness + ID check. This is what "qualified electronic signature" (QES) adds. For the ~5% of documents that matter enough to warrant it, the extra 10 minutes of identity verification is worth it.

Next

• PAdES explained
• E-signature audit trail
• SignBolt uses all of the above by default