Section 18.1. Using Digital Signatures | Word 2007[c] The Missing Manual

18.1. Using Digital Signatures

Just like a handwritten signature, a digital signature verifies the source of a document. For example, your signature on a check proves that the check came from you. If someone forges your signature on a check, then that check is void. For contracts and documents that need extra security, you go to a notary. You show proof of your identity, and the notary verifies that you signed the document in the notary's presence. The goal of digital signatures is to provide that kind of security to the documents and programs that you send and receive by email.

Digital signatures give security to both partiesthe person who creates and signs a document, and the person who receives it. Of course, digital signatures aren't handwrittenlike everything else in the digital world, they're made up of 1s and 0s. However, the cunning, clever software that creates digital signatures ensures that they're unique. As a result, you can use digital signatures to prove that:

A document came from a particular source or individual.
A document hasn't been tampered with since it was signed.
A document was read and agreed upon by the parties that signed it.

You have two ways to sign documents with a digital signature. You can create your own digital ID, which is the digital equivalent of signing a letter or a check without any witnesses. Or, you can purchase a digital ID from a third party that verifies your identitysort of like signing in front of a notary.

In Word 2007, Microsoft makes it easy for you to sign a document and for someone to verify your signature. The person who receives your document can be confident that it hasn't changed since you applied your signature. That's important for documents like sales contractsyou sure don't want someone changing the agreed upon price.

18.1.1. Creating Your Own Digital Signature

Before you can apply a digital signature to a document, you need to create it. You can create a self-signed digital signaturethat is, one you make yourselfright in Word.

Tip: If you want to create a third-party signature, you need to contract with a company known as a Certificate Authority. Details on third-party signatures begin in Section 18.1.4.

Here's how to create your first digital signature:

With your document open in Word, go to Office button Prepare Add a Digital Signature, as shown in Figure 18-1 .

If you don't already have a digital ID, the first time you try to add a digital signature to a document, you see an alert box explaining that Microsoft can't warrant a digital signature's enforceability. Bottom line: The legality of digital signatures hasn't been proven, and may vary from district to district . The box shows two options"Signature Services from the Office Marketplace" and OK. Click OK to open the "Get a Digital ID" box. From this box, you can either "Get a digital ID from a Microsoft partner" or "Create your own digital ID." (You won't see this box if you've already created a digital signature.)

Figure 18-1. Use the Prepare menu under the Office button to add a digital signature to your document. If you haven't created a digital signature, Word takes you through the steps to create one.

Choose "Create your own digital ID." When the Create a Digital ID box opens, type the information you want to appear as part of your digital signature, and then click Create .

You must enter a name , but the rest of the details (email address, organization, and location) are optional. When you click Create, Word stores your identity on your computer.

The ID you've just created will be available the next time you sign a document using the Office button Prepare Add a Digital Signature command, as described next.

18.1.2. Signing a Document with Your Digital Signature

After you've created a digital signature, it's simple to apply it to a document. Make sure you're finished editing the document, though. Once the digital signature is in place, you can't make any more changes.

With your document open in Word, go to Office button Prepare Add a Digital Signature .

An alert box appears that provides an explanation of digital signatures. It also gives you a chance to go to the Office Marketplace to purchase a third-party signature. (Once you get tired of Microsoft's sales pitch, you can click the "Don't show this message again" checkbox to bypass this alert in the future.)

Click OK to go with the self-signed digital signature that you created in the steps in Section 18.1.1. When the Sign box appears (Figure 18-2), type your reason for signing the document .

Now's your opportunity to explain why you're signing the document. This message becomes part of the document, and everyone who receives the document will see it.

Tip: If you have more than one signaturesay, a self-signed digital signature as well as a third-party signatureyou can click the Change button, and then choose the signature you want to use.

Figure 18-2. The Sign box appears when you add a digital signature to a document. Type your "Purpose for signing this document" in the text box. Click Change to use a different digital signature or to inspect the details of the signature that you're using.

Click the Sign button to complete the signature. When an alert box pops up saying that you were successful in signing the document, click OK .

As the alert box also says, the signature will be invalid if the document is changed. And, in fact, Word prevents you from making any changes; most ribbon commands are grayed out, and any attempts to edit text produce an error message. Also, if some nefarious person tries to hack the file in a program other than Word, the Digital Signature system detects the alteration.

After you click OK, Word returns you to your document, but, again, you won't be able to make any edits. The only way to make changes in Word is to remove the signature.

18.1.3. Adding a Microsoft Office Signature Line

Digital signatures like the one described in the previous section are hidden . In other words, the signature doesn't show up anywhere on the printed page. In Word, you see a message banner just below the ribbon announcing the presence of signatures. To see them, click the View Signatures button in this banner, or choose Office button Prepare View Signatures (Alt+F, EW), to open the Signatures pane. You can apply another type of signature to a document thats a hybrid of a digital and a handwritten signature: the Microsoft Office Signature line (Figure 18-3). It's a good option for contracts or other documents that need a visible signature of one or more people. With a digital signature line, you can send signed contracts back and forth via emailno postage required.

Figure 18-3. For documents that need to be visibly signed, use the Microsoft Office Signature line. In addition to having all the advantages of a digital signature, the signature line shows up in a printed document.

Suppose you're creating a lease agreement. You write up the contract, add two signature lines, and then sign one of them before emailing it to your business colleague. Here are the steps for this two-party document in detail.

Choose Insert Text Signature Line to open the Signature Setup box (Figure 18-4) .

You may see the alert box offering third-party signature services. If so, click OK to close the alert box and open the Signature Setup box.
In the Signature Setup box, type in the details that are to be included with the signature, and then click OK to close the box .

The Signature Setup box provides text boxes where you can enter name, title, email address, and instructions. You see two checkboxes: Turning on the "Allow the signer to add comments in the Sign dialog" box gives people signing the contract a way to communicate when they sign. It's a good idea to turn on the "Show sign date in the signature line" box so that the date the document was signed is recorded along with the signature.

Back in your document, press Tab, and then repeat steps 1 and 2 to insert a second signature line .

Specifically, open the Signature Setup box (Insert Text Signature Line). Type the details for the second person who will sign the document, and then click OK to close the box.

At this point, you have a document with two signature lines. No signatures have been attached, so you can still make changes to the document.

Figure 18-4. Use the Signature Setup box to attach additional information to the signature line. For example, you can include an email address for contact purposes or instructions for other people who are signing the document.

To open the Sign box, double-click the signature line that you want to sign .

You may see the alert box offering third-party signature services at this point. If so, click OK to close the alert box and open the Signature Setup box. (If you never want to see this sales pitch again, turn on the "Don't show this message again" checkbox.)
In the Sign box, type your signature or choose an image to represent your signature. If the "Allow the signer to add comments in the Sign dialog" option (mentioned in step 2) was turned on, you see a text box labeled "Purpose for signing this document." If you wish, type a message in the box .

The Sign box shows a big X where your signature is to appear. You can type your name, and it will appear next to the X in the document. But it's oh so much cooler to have a graphic representation of your signature. If you happen to be using a tablet PC with Windows XP Tablet PC Edition, you can sign on the line with your stylus; otherwise , you need a picture file (such as a JPG or a GIF file) of your signature stored on your computer.

To use a picture for your signature, click the "Select Image" link next to the box to choose a graphic signature. A standard Windows file box opens to let you select your signature's image file.

Tip: If you've got a graphic tablet on your computer, it's a snap to make a JPG of GIF of your signature. Otherwise, the best way to get a graphic image of your signature is to write it on a piece of paper and use a scanner to bring it onto your computer. You can also try taking a photo of your signature, but it won't be quite as clear as a scanned image.
Click OK to close the Sign box and complete the signature .

After the box closes , you see the signature on the line next to the X. The document also has a digital signature, and it's locked to prevent any more changes (Figure 18-5).

Figure 18-5. This document has two signature lines; the one on the left has already been signed. The signer inserted a picture file of his signature. Once the document is signed by one of the parties, no one can edit it, but the other party can sign on the other signature line.

18.1.4. Removing a Digital Signature

Once a document has a digital signature, you can't make changes to it. After all, one of the purposes of a digital signature is to prove that a document hasn't been altered since the time it was signed. As a result, sometimes it's necessary to remove a digital signature from a document. Here are the steps:

With the document open, choose Office Prepare View Signatures .

The Signatures pane opens.
In the Signatures pane, under Valid Signature, click the signature you want to remove. From the drop-down menu that appears, choose Remove Signature .

An alert box opens and asks "Are you sure you want to permanently remove this signature?"
Click Yes to remove the signature .

You can remove your signature, and often even someone else's signature, from a document. Once all the valid signatures are removed from a document, it can once again be edited.

18.1.5. Getting a Third-Party Digital Signature

Self-signed signatures are great for assuring everyone that a document hasn't been altered after you signed it, but they can't prove that you're actually who you say you are. The third-party digital signature is the electronic equivalent of a notarized document. Just as getting a document notarized means extra hassle and expense, third-party digital signatures require more time and effort than the self-signed variety. First, you must subscribe to a service, like the ones provided by one of Microsoft's Partners (Figure 18-6). The annual cost ranges from about $100 to $250, depending on the services you're buying.

Figure 18-6. You can purchase a digital signature from one of the Microsoft partners for about $100 to $250 a year. Prices vary depending in part on whether you're purchasing an individual signature or one for several employees in a company.

Once you've purchased a digital signature, you can add it to your documents the same way you added your self-signed signature, as described earlier. The difference is that people who receive your document have the added third-party assurance that you're legit. Third-party signatures are an important factor when you're using a macro or a Word add-in that someone else wrote. In that case, you're the one checking the signature, not the one creating it. The next section explains how to check a digital signature.

18.1.6. Checking a Digital Signature

When you open a Word document that has a digital signature, you see an icon that looks like a medallion in the status bar in the lower-left corner (Figure 18-7). Click this icon to open the Signatures pane (it opens to the right of your document). You can also open the Signatures pane with Office Prepare View Signatures or Alt+F, EW. In the Signatures pane, you see any valid signatures that you or anyone else has added to the document. Click a signature in the Signatures pane to open a drop-down menu (Figure 18-8). Choose Signatures Details to open a box that states whether or not the signature is valid and shows the purpose for signing the document. The View button leads to the Certificate box with even more details about the signature (Figure 18-9).

Figure 18-7. When you open a document that has a digital signature, you notice two things. First of all, you can't make changes to the document. You also see a medallion icon in your status bar (unless you've made changes to Word's factory settings). Click this icon to open the Signatures pane.

Figure 18-8. Open the Signatures pane (Alt+F,EW) and you see a list of valid signatures that are attached to the document. Open the drop-down menu attached to a name to view the Signature Details.

Figure 18-9. When you open a certificate for a digital signature, you see a box with two tabs. The General tab (not shown) lists who issued the certificate and whom it was issued to. Under the Details tab, you see a box showing Fields and Values. Click a field to view the details. For example, click the Issuer field to see the issuer's name and email address.

Here are the things to look for when you're checking a digital signature:

The Digital Signature Information icon . In the upper-left corner of the Digital Signatures box's General tab, you see an icon. For a document with a valid certificate, the icon looks like a certificate or an award. If something is wrong with the certificate, you see a document icon with a red circle and an X. This X icon may mean that the document was altered after it was signed, that the signature has expired , or that there's some other problem related to the certificate.
The digital signature is OK . This message appears on the General tab near the Digital Signature Information icon. You won't see this message if anyone altered the file (by removing a signature or tampering with it somehow) after it was signed.
The countersignatures timestamp . Third-party verified digital signatures receive a timestamp from the certificate authority (that is, the company providing the certificate). The date for the timestamp should be within the "Valid from" date range that's shown in the certificate, which you can view by clicking the View Certificate button.
Issue to name . The name of the person or company that created the document appears here.
Issued by name . The name of the certificate authority, if any, shows up here. Microsoft maintains a list of certificate authorities that are known as Microsoft Root Certificate Program Members, as well as descriptions of the practices they use to authenticate documents. Members include AOL, Certisign, eSign, GeoTrust, and Verisign.