Companies and SMBs that sign on paper
Contracts, minutes, orders and records that are printed, signed and scanned today.
SMARTLEDGE · digital identity
PKI and digital signatures: certificates and cryptographic tokens
PKI (public key infrastructure) issues and manages the digital certificates used to sign documents with legal value and to authenticate people, devices and services. SMARTLEDGE assesses, designs and deploys digital signatures, PKI and cryptographic credentials for companies, SMBs and public bodies in Argentina and other countries: we survey what is signed and who signs it, choose between tokens, smart cards or remote signing, integrate signing with your systems and organize the lifecycle of every certificate.
Printing, signing, scanning and filing takes time and leaves doubts about which version was signed. A digital signature records who signed and that the document has not changed since.
SL / 01What it is
What is the difference between a digital signature, an electronic signature and your own PKI?
In Argentina, Law 25,506 distinguishes the digital signature, made with a certificate from a licensed certifier, from the electronic signature, which covers any other method. An in-house PKI issues certificates for use within the organization: authenticating, encrypting and signing internal documents. Many organizations combine all three depending on the process.
| Electronic signature | Digital signature (Law 25,506) | The organization's own PKI | |
|---|---|---|---|
| What it is | Electronic signatureAny electronic signing method: acceptance on a platform, scanned signature, non-licensed certificate | Digital signature (Law 25,506)A signature made with a certificate issued by a licensed certifier | The organization's own PKICertificates issued by an in-house certificate authority, for use within the organization |
| If someone disputes it | Electronic signatureWhoever relies on it must prove it is authentic | Digital signature (Law 25,506)Whoever disputes it must prove it is false | The organization's own PKILegally an electronic signature; technical evidence and the documented procedure carry the weight |
| Where the key lives | Electronic signatureDepends on the method | Digital signature (Law 25,506)On a token, a smart card or a remote signing platform | The organization's own PKIOn tokens, smart cards, devices or an HSM, according to the defined policy |
| Typical use | Electronic signatureAcceptances, internal approvals and lower-risk processes | Digital signature (Law 25,506)Documents and procedures that legally require a signature | The organization's own PKIAuthentication of people and devices (VPN, Wi-Fi, sign-in), signed email and signing of internal documents |
General information about Law 25,506; not legal advice. Your legal adviser confirms which signature each document needs.
SL / 02Token
What is a cryptographic token and when does it make sense?
A cryptographic token is a USB device, or a smart card with a reader, that stores the certificate's private key and signs inside it: the key never leaves the device, is protected by a PIN and locks after several failed attempts. It makes sense when a person signs often from their workstation or uses the same certificate to authenticate. If people sign from different places, remote digital signing, with the key on the certifier's secure platform, simplifies logistics.
SL / 03What it includes
What we solve in a digital signature and PKI project
- Process survey: which documents are signed today, who signs them, which system they live in and what each one requires.
- Signature type per process: where a digital signature is needed and where an electronic signature is enough, to be validated with your legal adviser.
- Certificates and devices: cryptographic tokens and smart cards from G+D (Giesecke+Devrient) approved by Argentina's ONTI, Yubico YubiKey keys that combine PKI and FIDO2 in one device, or remote signing, depending on how much and from where each person signs.
- In-house PKI: your own certificate authority, hierarchy, policies and certificate templates to authenticate people, devices and services.
- Credential management: Versasec as the platform to manage the deployed PKI infrastructure: issuing, assigning tokens and smart cards, renewal and revocation from one place.
- Integration: signing from document management systems, email, VPN, Wi-Fi and sign-in, with the drivers and middleware each workstation needs.
- Lifecycle: issuance, renewal, expiry and revocation, with an inventory so no certificate expires unnoticed or stays active when someone leaves.
- Training: how to sign, how to verify a signature and what to do if a token is lost.
We select manufacturers and devices according to the project, its integration and its support. Scope, equipment and implementation are defined in writing in each proposal.
SL / 04Experience
PKI and digital signature projects
We have deployed PKI and digital signatures at institutions where trust in every signature and every certificate is critical:
- Central Bank of Argentina (BCRA), 2011: PKI for the MST system.
- UNDP – Argentina's Chief of Cabinet Office: PKI project.
- Argentina's National Judiciary (Council of the Magistracy), 2020: PKI with authentication and digital signature devices for signing case files.
- Buenos Aires Grain Exchange and Rosario Board of Trade, 2009–2014: the CONFIRMA project, tamper-proof digital signatures within a PKI.
These add to identity, credential and access projects such as the multi-use credential issuance for the Buenos Aires City Government (52 issuance points), the multi-application credentials at the Port of Buenos Aires and the biometric identity at ARSAT.
SL / 05Who it is for
Who needs digital signatures or a PKI?
Public bodies
Case files and acts that need a legally valid signature and traceability of who signed.
Organizations with many users and devices
Certificates for VPN, Wi-Fi, email and sign-in, issued and revoked in an orderly way.
IT teams with scattered certificates
When nobody knows how many certificates exist, who holds them or when they expire.
SL / 06How we work
What a project with SMARTLEDGE looks like
- Process first: what is signed, who signs it and what must be provable; the technology is chosen from there.
- Limited pilot: one process and a small group, with real documents, to adjust before expanding.
- Workstations ready: drivers, middleware and applications tested on the computers where people will sign.
- Written procedures: issuance, renewal, lost devices and revocation, rehearsed before going live.
- Support: with scope and response times agreed according to the operation.
One (1) day at your company. An assessment with no professional fees.
If you are not sure where to start, we start there: we review your operations and leave you written feedback with the best possible path in your technology context.
SMARTLEDGE covers the professional fees for the assessment and the written feedback. Travel expenses are covered by the prospect/customer. Offer available for Argentina, Chile, Paraguay and Uruguay.
Request a one-day assessment, no professional feesSL / 07Questions
Frequently asked questions
What is PKI?
PKI (public key infrastructure) is the set of certificate authorities, policies and procedures that issue, renew and revoke digital certificates. Each certificate binds a public key to a person, a device or a service, and makes it possible to sign, authenticate and encrypt with a private key that only its holder has.
What is the difference between a digital signature and an electronic signature?
In Argentina, Law 25,506 defines a digital signature as one made with a certificate issued by a licensed certifier; it satisfies the signature requirement when a law demands one, and whoever disputes it must prove it is false. Any other electronic signing method is an electronic signature: it can be valid, but if it is disputed, whoever relies on it must prove it is authentic. Your legal adviser confirms which signature each document needs.
What is a cryptographic token?
It is a device, usually USB or a smart card with a reader, that stores a certificate's private key and performs the signing operation inside, without the key ever leaving the device. It is protected by a PIN and locks after several failed attempts, so copying the certificate is not enough to sign on someone else's behalf.
How do you implement digital signatures in an organization?
Process by process. First survey the documents that are signed today, who signs them and what each one requires; then define where a digital signature is needed and where an electronic signature is enough, how certificates are obtained and stored (token, smart card or remote signing) and how signing is integrated with the systems where the documents live. Start with a pilot and document issuance, renewal and revocation.
Physical token or remote digital signing?
With a token, the key stays on a device the person carries and must plug in to sign. With remote digital signing, the key is kept on the certifier's secure platform and the person signs from the web with their credentials. Tokens are usually preferred when people sign a lot from the same workstation or also need the certificate to authenticate; remote signing simplifies logistics when people sign from different places.
What happens if the certificate expires or the token is lost?
Signatures made while the certificate was valid remain valid. If the token is lost or the key may be compromised, the certificate must be revoked immediately and a new one issued. That is why it helps to keep an inventory of certificates and their expiry dates, and a revocation procedure everyone knows.
Digital signature or FIDO2?
They solve different problems and can coexist. Digital signatures with certificates are used to sign documents with legal value and, with PKI, also to authenticate people and devices. FIDO2 and passkeys are used to sign in without a password, with phishing resistance. Some devices support both uses if the model allows it.
How much does it cost to implement digital signatures or a PKI?
It depends on the number of people and devices, the type of certificate and device, whether an in-house certificate authority is used and how many systems must be integrated. We quote after surveying the processes.
SL / 10
Contact
Let's talk about your challenge
Tell us which process you want to improve, what happens today and what outcome you need. That gives us a starting point to define the scope and next step.
Thank you. We received your message and will get back to you shortly.