Electronic signature vs digital signature: which is which

Electronic signature is the legal umbrella: any data in electronic form used by a signatory to sign (eIDAS article 3(10); the same tech-neutral idea runs through the US ESIGN Act and UETA). Digital signature is the cryptographic technique: the result of a digital signature algorithm operating on data, created with a private key and verifiable with the corresponding public key.

Every digital signature is an electronic signature. Most electronic signatures — typed names, scanned images, drawn lines — are not digital signatures in the cryptographic sense.

The standard construction, as NIST describes it, is two steps: a hash function over the data, followed by the signature function over that hash. The signer's private key produces the signature; anyone with the public key can verify it — which gives origin authentication, integrity protection and non-repudiation when implemented properly. The current NIST standard for the algorithms is FIPS 186-5.

The properties are mathematical, not behavioural: change one byte of the signed data and verification fails; there is no practical way to produce a different document carrying the same signature.

In a compliant signing product, the electronic signature is the legal act, and the digital signature is the integrity and identity layer underneath it. The line a signer draws in the ceremony is the visible electronic signature; the PAdES cryptographic signature over the exact bytes — with the signer's certificate and a trusted timestamp — is what makes that act verifiable later, by anyone, in any validator.

So when a product says 'digital signatures', the useful question is not whether but which profile: a bare cryptographic signature, or a PAdES baseline profile (B-B, B-T, B-LT, B-LTA) with timestamps and embedded validation data. The profile determines whether the proof survives certificate expiry and service shutdown.

Marketing has flattened the two words because 'digital' sounds more secure than 'electronic'. The drift does no harm until someone relies on it — assuming the word 'digital' on a pricing page implies a certificate-based signature, or that 'electronic' implies weak evidence. Neither assumption follows from the words.

The question that gets you real information: what evidence does the finished document carry, and can someone verify it without your vendor's cooperation? A PAdES file that embeds its validation data answers both in the file itself.